Network guy working on Security problems -- hoping for some guidance!

I have a subnet that I am using as a NAT block for one of my inside subnets.

NAT from inside->outside : Convert source to

I am doing EIGRP with the outside. I need to originate and advertise it to the outside EIGRP neighbor. However, the ASA won't originate the block because its not in the routing table.

CiscoASA#show route | inc

I tried doing an interface-level summary to override this behavior.

interface Port-channel21 (outside interface)
 summary-address eigrp 10

CiscoASA#show route | inc|Null0

But the route still isn't in the table, no Null0 route gets generated, and the neighbor doesn't see the summary.

As far as I can tell, there is no static null route or loopback interface functionality in the code I'm using (9.1).

What is the correct way to get a NAT block into the routing table, and then into EIGRP?

  • Any update on this matter? I have an issue about Dynamic Routing configuration on ASA's...I wonder if this has been addressed in later IOS rev's?
    – user8350
    Commented Sep 8, 2014 at 18:01

2 Answers 2


Creating a static route for "" and redistributing it to EIGRP should do the trick.

The static route would lift it into the routing table and the redistribution of static routs will announce the route to the EIGRP neighbors.

  • What would I point the static too? No null0 interface on the ASA. Will it break anything if I point to the next-hop that I'm advertising to?
    – Keller G
    Commented Apr 21, 2014 at 8:04
  • As the ASA is checking the translation rules BEFORE it is checking the routing table. Therefore, the next-hop destination doesn't really matter. Null0 should be fine without breaking something. Here is a short overview of the packet-flow through the ASA: learningnetwork.cisco.com/servlet/JiveServlet/download/…
    – bammel
    Commented Apr 21, 2014 at 19:04
  • I would love to point the route to null0. How does one do that on an ASA?
    – Keller G
    Commented Apr 21, 2014 at 20:11
  • You are right. No Null0 in an ASA. Choose another destination like a next hop. It doesn't really matter. The NAT on the ASA will take place before the routing-table-lookup.
    – bammel
    Commented Apr 22, 2014 at 20:27
  • Well, I'm not a big fan of this answer because it feels pretty hackish, but it does in fact work!
    – Keller G
    Commented Apr 25, 2014 at 20:36

Looks like you CAN do static null0 routes in ASA 9.2(1). You would then redistribute the static into EIGRP.


route null0
  • Following up here. As of ASA 9.2(2), a null route is not redistributed into EIGRP with the "redistribute static" command. I am working with TAC on hopefully getting this fixed!
    – Keller G
    Commented Jul 1, 2014 at 21:24
  • This should be fixed and working as of ASA per TAC!
    – Keller G
    Commented Dec 30, 2014 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.