Sep
09

This post was created using GNS3 and follows what I thought was some of the most lab and real-world relevant content from the Cisco ASA documentation in the area of IP Routing:

 

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/ip.html

 

Here is the topology used:

 The Topology

 

Initial Setup

First, we place the necessary IP configurations on the devices for our initial connectivity:

R0:
en
conf t
host R0
line con 0
exec-time 0 0
logg synch
!
int fa0/0
no shut
ip address 192.168.1.100 255.255.255.0
end
R1:
en
conf t
host R1
line con 0
exec-time 0 0
logg synch
int fa0/0
no shut
ip address 10.10.10.100 255.255.255.0
!
interface loopback 20
ip address 10.10.20.100 255.255.255.0
end
R2:
en
conf t
host R2
line con 0
exec-time 0 0
logg synch
int fa0/0
no shut
ip address 172.16.1.100 255.255.255.0
end
FW0:
en
conf t
host FW0
!
int e0
ip address 192.168.1.1 255.255.255.0
nameif outside
no shut
!
int e1
ip address 10.10.10.1 255.255.255.0
nameif inside
no shut
!
int e2
ip address 172.16.1.1 255.255.255.0
nameif DMZ
security-level 50
no shut
!
end

At this point, I will be sure to ping each connected router from the PIX to ensure IP connectivity. Remember, by default you can ping from the PIX and to the PIX, but you cannot ping through the PIX.

Static Routing

First, I will create a simple static route to the “remote” loopback network that I have created on R1. Notice that to create a static route we simply use the route command, followed by the interface name, then the network and mask, and finally the next hop. Notice how similar this is to the syntax for a static route on a router, although one major difference is the command does not begin with ip.

FW0:
conf t
route inside 10.10.20.0 255.255.255.0 10.10.10.100
end  

Verification of this static route can be accomplished with a show route and a ping of the remote destination address 10.10.20.100.

Default Static Routing

In order to configure a default static route, use the route command but with an all 0′s network prefix and mask. The PIX/ASA allow a shortcut of 0 and 0 to represent 0.0.0.0 and 0.0.0.0. Here I configure a default static route pointing to our outside router.

FW0:
conf t
route outside 0 0 192.168.1.100
end

Verification for this configuration is a quick show route. The PIX/ASA should now show a gateway of last resort and the static route should be marked as a candidate default.

Static Route Tracking

An issue with the static route we just configured is the fact that if the destination gateway of last resort is down, the route is not removed from the routing table. This issue can be circumvented with the static route tracking capability.

First, I use the Cisco IOS IP Service Level Agreements (SLAs) monitor feature to track the availability of the gateway. This is done with the following commands:

FW0:
conf t
sla monitor 1
type echo protocol ipIcmpEcho 192.168.1.100 interface outside
exit
sla monitor schedule 1 life forever start-time now
end

Notice these commands instruct the SLA monitor to ping the gateway starting now and to do this forever. I picked an SLA_ID of 1 to bind these commands together.

Next, I will associate a tracked static route with the SLA monitoring process using the following commands. Notice here that I have used a Track_ID of 20 and I have recreated our default static route so that it includes the Track_ID. Notice also here that the track command is tied to the SLA monitor with the SLA_ID of 1.

FW0:
conf t
track 20 rtr 1 reachability
route outside 0 0 192.168.1.100 track 20
end

A nifty verification at this point is to move to R0 (the gateway of last resort) and run debug ip icmp. You will find that this router is being pinged every minute by the firewall now as a reachability test.

Next, I create a backup default static route. This is simply another default static route entry that possesses a higher administrative distance than the original static default route:

FW0:
conf t
route outside 0 0 192.168.1.55 22

For verification, you can shut the interface on the default gateway and run a show route on the PIX/ASA to ensure the backup is installed.

Dynamic Routing – OSPF

Now it is time to tackle a dynamic routing protocol configuration. Here I configure an MD5 authenticated neighborship between R2 and FW0. Notice that the network command on the PIX/ASA requires a subnet mask as opposed to a wildcard mask.

R2:
conf t
router ospf 1
network 172.16.1.100 0.0.0.0 area 0
!
interface fastethernet 0/0
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 cisco
!
end
FW0:
conf t
router ospf 1
network 172.16.1.1 255.255.255.255 area 0
!
interface e2
ospf authentication message-digest
ospf message-digest-key 1 md5 cisco
!
end

For verification, simply run show ospf neighbor on FW0.

Dynamic Routing – RIP version 2

Next, we will run RIP version 2 on the PIX/ASA and advertise the DMZ subnet to the internal router R1. Here are the configurations:

R1:
conf t
router rip
version 2
no auto-summary
passive-interface default
network 10.0.0.0
no passive-interface fa0/0
end
FW0:
conf t
router rip
version 2
no auto-summary
network 172.16.0.0
network 10.0.0.0
end

 Verification for RIP in this example would include show ip route on R1 and debug rip on FW0.  

Conclusion

I certainly hope you have enjoyed this blog on IP routing with the PIX/ASA. While my goal was to hit the highlights, please keep in mind the fact that there are many features of the dynamic routing protocols that are available and not covered here. In fact, there are even some static routing features that were omitted in this discussion. Just remember that these features should be very easy to find in the documentation link when you are in the heat of battle.


You can leave a response, or trackback from your own site.

12 Responses to “IP Routing on the PIX/ASA”

 
  1. Maxwell says:

    Hi,

    Firstly welcome to Internetwork expert team. I am happy to see posts from you as I have seen your training material before with other vendors and they are really interesting and fun to study.

    I would like to see more advanced PIX/ASA scenarios in feature, with regard to stuff like QOS, Multicast on ASA code and if possible the new Blue Print ASA 8.0 code features.

    Thanks a lot again.

    Maxwell

  2. Good article,

    I would like to add that the PIX/ASA platform does not issue ICMP redirects, so be careful. A packet cannot be routed to an IP on the same interface on which it was received; it just gets dropped, and you’re left scratching your head as to where it went.

  3. To Maxwell:

    Thanks so much for the kind words! I am so thrilled to be here at InternetworkExpert I hope that my training becomes even more fun and even more interesting :-) No if I can only get my wife to consider me fun and interesting.

    Petr here at InternetworkExpert recommended the same blog entries as you! I will be sure to get on those this week.

  4. To Aaron:

    Great addition to the blog – thanks for that and thanks for reading!

  5. Cisco Guy says:

    This is a great post. Your scenario above can be used as a base to configure ISP redundancy (two ISP connections on your ASA) with the help of the SLA monitor feature.

  6. To Cisco Guy:

    Thanks so much!

    Yeah, the documentation link comes right out and states a great target might be the ISP gateways for dual IPS suppost.

    It also brings up another great potential target, a key server (like a AAA) server that the system must communicate with.

    Thanks for reading!

  7. Can you show how the static route tracking works? I cant get it to start using the backup route.

  8. Hi Brandon!

    There is no magic that I have seen required to get it started. The config above is complete.

    Be sure to check for ICMP reachability between the devices. It is a simple ping to ensure reachability.

    Remember debug ip icmp can help for verification.

  9. Cisco Dave says:

    I referenced this example because I’m currently working my CCIE Security workbook volume 1 v3.0 (Pg 19 – 25) on Access Control. I found it helpful, but still seem to be having a problem pinging from the router on the outside interface of the PIX/ASA towards the AAA Server connected to the DMZ interface of the PIX/ASA. I must be missing something simple, but I’ve checked and rechecked my configurations. Any thoughts?

    Note: I’m able to ping from the PIX/ASA to each, so I know the devices are up and responding.

    Thanks in Advance.

  10. This question will get better attention on our http://www.ieoc.com forum. It sounds like your problem is pinging through the PIX, which is not permitted by default. You can ping to the PIX, but not through it. If you add ICMP to your traffic being inspected you should be fine.

  11. Cisco Dave says:

    Putting a post on ieoc.com per your suggestion too… To clarify I’m able to ping from inside to outside, but not inside to dmz nor outside to dmz (with permit statements applied to outside interfaces as well). I added icmp to the global inspect list, but no dice. I’m at a loss as I’m able to ping the 10.0.0.100 from the ASA as it’s directly connected of course, but I’m not able to ping from neither r1 (inside) nor r2 (outside) to the dmz device (10.0.0.100). It’s gotta be something I’m missing on the ASA, but the lab workbook doesn’t provided any further configurations… according to the lab work book it should be working as I have it. Thoughts?

    Thanks in Advance.

  12. Aditya says:

    Hi,

    gr8 article..

    I am new to gns3..can u guide me what is system configuration should be to work in gns3 with FW and some 4-5 routers…

    Thanks

 

Leave a Reply

Categories

CCIE Bloggers