4

Network guy working on Security problems -- hoping for some guidance!

I have a subnet that I am using as a NAT block for one of my inside subnets.

NAT from inside->outside : Convert source 10.0.0.0/23 to 10.100.0.0/23

I am doing EIGRP with the outside. I need to originate 10.100.0.0/23 and advertise it to the outside EIGRP neighbor. However, the ASA won't originate the block because its not in the routing table.

CiscoASA#show route | inc 10.100.0.0
CiscoASA#

I tried doing an interface-level summary to override this behavior.

interface Port-channel21 (outside interface)
 summary-address eigrp 10 10.100.0.0 255.255.254.0

CiscoASA#show route | inc 10.100.0.0|Null0
CiscoASA#

But the route still isn't in the table, no Null0 route gets generated, and the neighbor doesn't see the summary.

As far as I can tell, there is no static null route or loopback interface functionality in the code I'm using (9.1).

What is the correct way to get a NAT block into the routing table, and then into EIGRP?

Improve this question
1
  • Any update on this matter? I have an issue about Dynamic Routing configuration on ASA's...I wonder if this has been addressed in later IOS rev's?
    – user8350
    Sep 8, 2014 at 18:01

2 Answers 2

Reset to default
5

Creating a static route for "10.100.00.0/23" and redistributing it to EIGRP should do the trick.

The static route would lift it into the routing table and the redistribution of static routs will announce the route to the EIGRP neighbors.

Improve this answer
5
  • What would I point the static too? No null0 interface on the ASA. Will it break anything if I point to the next-hop that I'm advertising to?
    – Keller G
    Apr 21, 2014 at 8:04
  • As the ASA is checking the translation rules BEFORE it is checking the routing table. Therefore, the next-hop destination doesn't really matter. Null0 should be fine without breaking something. Here is a short overview of the packet-flow through the ASA: learningnetwork.cisco.com/servlet/JiveServlet/download/…
    – bammel
    Apr 21, 2014 at 19:04
  • I would love to point the route to null0. How does one do that on an ASA?
    – Keller G
    Apr 21, 2014 at 20:11
  • You are right. No Null0 in an ASA. Choose another destination like a next hop. It doesn't really matter. The NAT on the ASA will take place before the routing-table-lookup.
    – bammel
    Apr 22, 2014 at 20:27
  • Well, I'm not a big fan of this answer because it feels pretty hackish, but it does in fact work!
    – Keller G
    Apr 25, 2014 at 20:36
1

Looks like you CAN do static null0 routes in ASA 9.2(1). You would then redistribute the static into EIGRP.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/route-static.html#pgfId-1241233

route null0 192.168.2.0 255.255.255.0
Improve this answer
2
  • Following up here. As of ASA 9.2(2), a null route is not redistributed into EIGRP with the "redistribute static" command. I am working with TAC on hopefully getting this fixed!
    – Keller G
    Jul 1, 2014 at 21:24
  • This should be fixed and working as of ASA 9.2.2.5 per TAC!
    – Keller G
    Dec 30, 2014 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.