klulue123
asked on
Cisco OSPF routers and ASA
I am pulling my hair out trying to figure this out, so any help is greatly appreciated.
I have a client that has a VPN between the main location and two remote locations using ASA to ASA VPN. That works fine. The main data network is 192.168.100.0 Since then we have added an IP phone system on a separate internal network behind a router (192.168.10.x). That was OK, but now we are adding another building with a site to site which needs Internet through the whole line. I am trying to get OSPF to handle the routing and the routes are not populating across. On the main data network I have the default gateway as the router between the data and phone network and then out through the ASA. I dont remember if the phone network used to get to the Internet or not (I think it did), but since I have been trying to get this working, I have lost that as well. I had static routes in for most that I have removed hoping to get OSPF to fill them in. I think all pertinent configs are listed below. When I try to debug ip ospf any part, there is no activity on any of the routers. The ASA does show some ospf notifications, but I configured it using both command line and ASDM and not sure what changed what.
Thanks.
ASA
ASA Version 7.2(3)
!
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.100.253 255.255.255.0
ospf cost 10
ospf message-digest-key 1 md5 <removed>
ospf authentication message-digest
!
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.224
ospf cost 10
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
!
route-map name permit 1
!
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
!
router ospf 1
router-id 192.168.100.253
network 192.168.100.0 255.255.255.0 area 20
log-adj-changes
redistribute static
!
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.168.100.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
pre-shared-key *
prompt hostname context
R1
!
interface FastEthernet0/0
ip address 192.168.100.254 255.255.255.0
ip access-group 100 in
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 cisco123
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.10.1 255.255.255.0
ip access-group 100 in
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
network 192.168.10.0 0.0.0.255 area 10
network 192.168.100.0 0.0.0.255 area 20
!
ip route 0.0.0.0 0.0.0.0 192.168.100.253 permanent
ip route 192.168.10.0 255.255.255.0 FastEthernet0/1
ip route 192.168.100.0 255.255.255.0 FastEthernet0/0
!
no ip http server
R2
interface FastEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$I NTF-INFO-F E 0$$ES_LAN$$FW_INSIDE$
ip address 192.168.10.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
interface FastEthernet0/1
description $FW_OUTSIDE$$ES_WAN$
ip address 10.0.0.2 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
router ospf 1
log-adjacency-changes
network 10.0.0.0 0.0.0.255 area 50
network 192.168.10.0 0.0.0.255 area 10
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.10.1
ip route 192.168.100.0 255.255.255.0 192.168.10.1
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet0/1 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=FastEthernet0/0
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.10.0 0.0.0.255
!
R3
interface FastEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$I NTF-INFO-F E 0$$ES_LAN$$FW_INSIDE$
ip address 192.168.30.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
interface FastEthernet0/1
description $FW_OUTSIDE$$ES_WAN$
ip address 10.0.0.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
router ospf 1
log-adjacency-changes
network 10.0.0.0 0.0.0.255 area 50
network 192.168.30.0 0.0.0.255 area 30
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
ip route 192.168.10.0 255.255.255.0 10.0.0.2
ip route 192.168.100.0 255.255.255.0 10.0.0.2
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet0/1 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=FastEthernet0/0
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.30.0 0.0.0.255
!
!
control-plane
!
I have a client that has a VPN between the main location and two remote locations using ASA to ASA VPN. That works fine. The main data network is 192.168.100.0 Since then we have added an IP phone system on a separate internal network behind a router (192.168.10.x). That was OK, but now we are adding another building with a site to site which needs Internet through the whole line. I am trying to get OSPF to handle the routing and the routes are not populating across. On the main data network I have the default gateway as the router between the data and phone network and then out through the ASA. I dont remember if the phone network used to get to the Internet or not (I think it did), but since I have been trying to get this working, I have lost that as well. I had static routes in for most that I have removed hoping to get OSPF to fill them in. I think all pertinent configs are listed below. When I try to debug ip ospf any part, there is no activity on any of the routers. The ASA does show some ospf notifications, but I configured it using both command line and ASDM and not sure what changed what.
Thanks.
ASA
ASA Version 7.2(3)
!
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.100.253 255.255.255.0
ospf cost 10
ospf message-digest-key 1 md5 <removed>
ospf authentication message-digest
!
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.224
ospf cost 10
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
!
route-map name permit 1
!
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
!
router ospf 1
router-id 192.168.100.253
network 192.168.100.0 255.255.255.0 area 20
log-adj-changes
redistribute static
!
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.168.100.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
pre-shared-key *
prompt hostname context
R1
!
interface FastEthernet0/0
ip address 192.168.100.254 255.255.255.0
ip access-group 100 in
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 cisco123
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.10.1 255.255.255.0
ip access-group 100 in
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
!
router ospf 1
log-adjacency-changes
network 192.168.10.0 0.0.0.255 area 10
network 192.168.100.0 0.0.0.255 area 20
!
ip route 0.0.0.0 0.0.0.0 192.168.100.253 permanent
ip route 192.168.10.0 255.255.255.0 FastEthernet0/1
ip route 192.168.100.0 255.255.255.0 FastEthernet0/0
!
no ip http server
R2
interface FastEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$I
ip address 192.168.10.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
interface FastEthernet0/1
description $FW_OUTSIDE$$ES_WAN$
ip address 10.0.0.2 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
router ospf 1
log-adjacency-changes
network 10.0.0.0 0.0.0.255 area 50
network 192.168.10.0 0.0.0.255 area 10
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 192.168.10.1
ip route 192.168.100.0 255.255.255.0 192.168.10.1
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet0/1 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=FastEthernet0/0
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.10.0 0.0.0.255
!
R3
interface FastEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$I
ip address 192.168.30.254 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
interface FastEthernet0/1
description $FW_OUTSIDE$$ES_WAN$
ip address 10.0.0.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
!
router ospf 1
log-adjacency-changes
network 10.0.0.0 0.0.0.255 area 50
network 192.168.30.0 0.0.0.255 area 30
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
ip route 192.168.10.0 255.255.255.0 10.0.0.2
ip route 192.168.100.0 255.255.255.0 10.0.0.2
!
!
ip http server
ip http access-class 23
ip http authentication local
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet0/1 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=FastEthernet0/0
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.30.0 0.0.0.255
!
!
control-plane
!
Can you provide a diagram of how this is all connected?
Where is your area 0 for OSPF?
You have acls on the interfaces on R1. Is ospf allowed through the acl?
You are natting on the other routers. You're not going to get OSPF through the natted interfaces, so I'm not sure what you are trying to accomplish..
You have acls on the interfaces on R1. Is ospf allowed through the acl?
You are natting on the other routers. You're not going to get OSPF through the natted interfaces, so I'm not sure what you are trying to accomplish..
ASKER
I appoligize, I had tried to condense the configs. Attached are the configs for all devices and a quick map in Visio (pdf). Going back over the configs, I see some NAT commands in the last two routers, these are new 1841 and most of the commands are left from out of the box.
As for the ACL in R1, I don't remember why it is there, can it be removed? Very simply, I need Internet access from R3 through all devices. I think my problem has been that I made this more complicated than it needed to be and it has just gotten me confussed. If there is a simpler way, I am very open for suggestions.
Thanks.
ASA.doc
R3.doc
R2.doc
R1.doc
Network-1.pdf
As for the ACL in R1, I don't remember why it is there, can it be removed? Very simply, I need Internet access from R3 through all devices. I think my problem has been that I made this more complicated than it needed to be and it has just gotten me confussed. If there is a simpler way, I am very open for suggestions.
Thanks.
ASA.doc
R3.doc
R2.doc
R1.doc
Network-1.pdf
You are making it much more complicated than it needs to be.
R3:
interface fast 0/0
no ip nat inside
interface fast 0/1
no ip nat outside
no router ospf 1
no ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
ip route 0.0.0.0 0.0.0.0 10.0.0.2
Done.
R2:
interface fast 0/0
no ip nat inside
interface fast 0/1
no ip nat outside
router odr
router ospf 1
no network 10.0.0.0 0.0.0.255 area 90
network 192.168.10.0 0.0.0.255 area 10
redist odr subnet
Everything else stays as is..
R1:
interface fast 0/0
no ip access-group 100 in
interface fast 0/1
no ip access-group 100 in
no ip route 192.168.10.0 255.255.255.0 FastEthernet0/1
no ip route 192.168.100.0 255.255.255.0 FastEthernet0/0
router ospf 1
network 192.168.10.0 0.0.0.255 area 10
no network 192.168.100.0 0.0.0.255 area 20
network 192.168.100.0 0.0.0.255 area 0
ASA:
no route inside 192.168.10.0 255.255.255.0 192.168.100.254 1
no route inside 192.168.30.0 255.255.255.0 10.0.0.1 3
no route inside 10.0.0.0 255.255.255.0 192.168.100.253 2
router ospf 1
network 192.168.100.0 255.255.255.0 area 0
no redistribute static
Now,
R3 has a simple default route to R2
R2 learns R3's network via ODR (with CDP)
R2 redistributes R3's network out OSPF to R1
R1 learns R3's network and R2's network from R2
R1 has default route to ASA
ASA learns R3's and R2's networks from R1
All should be happy
R3:
interface fast 0/0
no ip nat inside
interface fast 0/1
no ip nat outside
no router ospf 1
no ip route 0.0.0.0 0.0.0.0 FastEthernet0/1
ip route 0.0.0.0 0.0.0.0 10.0.0.2
Done.
R2:
interface fast 0/0
no ip nat inside
interface fast 0/1
no ip nat outside
router odr
router ospf 1
no network 10.0.0.0 0.0.0.255 area 90
network 192.168.10.0 0.0.0.255 area 10
redist odr subnet
Everything else stays as is..
R1:
interface fast 0/0
no ip access-group 100 in
interface fast 0/1
no ip access-group 100 in
no ip route 192.168.10.0 255.255.255.0 FastEthernet0/1
no ip route 192.168.100.0 255.255.255.0 FastEthernet0/0
router ospf 1
network 192.168.10.0 0.0.0.255 area 10
no network 192.168.100.0 0.0.0.255 area 20
network 192.168.100.0 0.0.0.255 area 0
ASA:
no route inside 192.168.10.0 255.255.255.0 192.168.100.254 1
no route inside 192.168.30.0 255.255.255.0 10.0.0.1 3
no route inside 10.0.0.0 255.255.255.0 192.168.100.253 2
router ospf 1
network 192.168.100.0 255.255.255.0 area 0
no redistribute static
Now,
R3 has a simple default route to R2
R2 learns R3's network via ODR (with CDP)
R2 redistributes R3's network out OSPF to R1
R1 learns R3's network and R2's network from R2
R1 has default route to ASA
ASA learns R3's and R2's networks from R1
All should be happy
Question @ lrmore - that is still relying on the staticly configured defaults, wouldn't you be best off @ the ASA to default-information originate in the OSPF process?
You could, but I wouldn't bet on it propagating to R3
I'm trying to keep it simple. There is no other potential default gateway, so it will never change.
I'm trying to keep it simple. There is no other potential default gateway, so it will never change.
Well, no I wouldn't expect it to propagate end-to-end but in terms of transit device management overhead. Just curious, my OSPF is lacking.
ASKER
@ Irmoore -
I attempted the commands, and from R3, I can only ping R2 - Pings to R1 fail. R2 pings only 10.0.0.1 and 192.168.10.1 - pings to 192.168.100.253 (outside of R1) fail. I must have missed something in either R1 or R2. I have been working with this for about a week and I think it is starting to blur for me. I have attached the config for the three routers again. Would you mind please looking again and seeing what I missed? Do I need to remove more of the original config on R2 & R3?
Thanks
R1.doc
R2.doc
R3.doc
I attempted the commands, and from R3, I can only ping R2 - Pings to R1 fail. R2 pings only 10.0.0.1 and 192.168.10.1 - pings to 192.168.100.253 (outside of R1) fail. I must have missed something in either R1 or R2. I have been working with this for about a week and I think it is starting to blur for me. I have attached the config for the three routers again. Would you mind please looking again and seeing what I missed? Do I need to remove more of the original config on R2 & R3?
Thanks
R1.doc
R2.doc
R3.doc
R2:
no ip route 192.168.30.0 255.255.255.0 10.0.0.1
router ospf 1
redist connected subnet
How about capture the following from each router
sho ip route
sho ip ospf neigh <-- R2,3 only
no ip route 192.168.30.0 255.255.255.0 10.0.0.1
router ospf 1
redist connected subnet
How about capture the following from each router
sho ip route
sho ip ospf neigh <-- R2,3 only
ASKER
OK,
R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.10.1 to network 0.0.0.0
C 192.168.10.0/24 is directly connected, FastEthernet0/0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [1/0] via 192.168.10.1
R2#sh ip ospf nei
R2#
and ....
R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0.2 to network 0.0.0.0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [1/0] via 10.0.0.2
R3#sh ip ospf nei
R3#
looking at this, on the ASA if I debug ospf event I get this output:
ciscoasa#
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2
OSPF: Send with youngest Key 1
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2
OSPF: Send with youngest Key 1no
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2de
OSPF: Send with youngest Key 1bug all
ciscoasa#
where if I type debug ip ospf event (or adj / hello / tree / or any other debug for ospf) I don't get anything back.
I don't know if this helps, but I type sh ip ospf data on R1 and I have:
R1#sh ip ospf data
OSPF Router with ID (192.168.100.254) (Process ID 1)
Router Link States (Area 0)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.254 192.168.100.254 293 0x8000000F 0x003784 1
Summary Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
192.168.10.0 192.168.100.254 293 0x8000000F 0x00925B
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.254 192.168.100.254 293 0x80000013 0x000210 1
Summary Net Link States (Area 10)
Link ID ADV Router Age Seq# Checksum
192.168.100.0 192.168.100.254 293 0x8000000F 0x00B0E2
R1#
on R2:
R2#sh ip ospf data
OSPF Router with ID (10.0.0.2) (Process ID 1)
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
10.0.0.2 10.0.0.2 675 0x80000013 0x008294 0
Type-5 AS External Link States
Link ID ADV Router Age Seq# Checksum Tag
10.0.0.0 10.0.0.2 675 0x8000000F 0x00E299 0
R2#
and on R3 there is no output for the command.
I think this is telling me that ospf is not working, but i can' t find anything that says how to fix it. I found a few that say to use the debug command to troubleshoot, but when I don't get anything from the command at all, I don't know what that is telling me other than ospf is not running??????
Thanks
R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.10.1 to network 0.0.0.0
C 192.168.10.0/24 is directly connected, FastEthernet0/0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [1/0] via 192.168.10.1
R2#sh ip ospf nei
R2#
and ....
R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0.2 to network 0.0.0.0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [1/0] via 10.0.0.2
R3#sh ip ospf nei
R3#
looking at this, on the ASA if I debug ospf event I get this output:
ciscoasa#
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2
OSPF: Send with youngest Key 1
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2
OSPF: Send with youngest Key 1no
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2de
OSPF: Send with youngest Key 1bug all
ciscoasa#
where if I type debug ip ospf event (or adj / hello / tree / or any other debug for ospf) I don't get anything back.
I don't know if this helps, but I type sh ip ospf data on R1 and I have:
R1#sh ip ospf data
OSPF Router with ID (192.168.100.254) (Process ID 1)
Router Link States (Area 0)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.254 192.168.100.254 293 0x8000000F 0x003784 1
Summary Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
192.168.10.0 192.168.100.254 293 0x8000000F 0x00925B
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.254 192.168.100.254 293 0x80000013 0x000210 1
Summary Net Link States (Area 10)
Link ID ADV Router Age Seq# Checksum
192.168.100.0 192.168.100.254 293 0x8000000F 0x00B0E2
R1#
on R2:
R2#sh ip ospf data
OSPF Router with ID (10.0.0.2) (Process ID 1)
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
10.0.0.2 10.0.0.2 675 0x80000013 0x008294 0
Type-5 AS External Link States
Link ID ADV Router Age Seq# Checksum Tag
10.0.0.0 10.0.0.2 675 0x8000000F 0x00E299 0
R2#
and on R3 there is no output for the command.
I think this is telling me that ospf is not working, but i can' t find anything that says how to fix it. I found a few that say to use the debug command to troubleshoot, but when I don't get anything from the command at all, I don't know what that is telling me other than ospf is not running??????
Thanks
On all routers, use sho CDP neighbor to make sure that the neighbor on either side is seen and is the right one.
R2 is not learning a route to R3 network over ODR which uses CDP
The data shown for R1 shows that it is seeing both neighbors. The only thing is that it is not learning the network for R3
Static routes always override what gets learned.
Do this:
Change all statics to add administrative distance. This will let learned routes be injected into the route table.
i.e.
no ip route 0.0.0.0 0.0.0.0 x.x.x.x
ip route 0.0.0.0 0.0.0.0 x.x.x.x 120
Check to make sure that no routing protocol is running at all on R3
R2 is not learning a route to R3 network over ODR which uses CDP
The data shown for R1 shows that it is seeing both neighbors. The only thing is that it is not learning the network for R3
Static routes always override what gets learned.
Do this:
Change all statics to add administrative distance. This will let learned routes be injected into the route table.
i.e.
no ip route 0.0.0.0 0.0.0.0 x.x.x.x
ip route 0.0.0.0 0.0.0.0 x.x.x.x 120
Check to make sure that no routing protocol is running at all on R3
ASKER
OK - starting at the back (R3)
R3#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
Peters.2003premier.com
Fas 0/1 169 R S I 1841 Fas 0/1
R3#
R2#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
Switch Fas 0/0 172 S I WS-CE500- Fas 1
Engineers.2003premier.com
Fas 0/1 167 R S I 1841 Fas 0/1
R2#
R1#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
Switch2 Fas 0/1 178 S I WS-CE500- Gig 2
R1#
This shows R1 connected to switch 2 - switch2 to is uplinked to Switch which R2 shows as a CDP neighbor, so I think that is working. R2 and R3 both show each other - this is a fiber connection between the two buildings about two miles apart that goes through AT&T network - What I don't understand is why the routers don't show any output when debug ospf commands are used. Could it be that ospf is not working?
R3#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
Peters.2003premier.com
Fas 0/1 169 R S I 1841 Fas 0/1
R3#
R2#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
Switch Fas 0/0 172 S I WS-CE500- Fas 1
Engineers.2003premier.com
Fas 0/1 167 R S I 1841 Fas 0/1
R2#
R1#sh cdp nei
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
S - Switch, H - Host, I - IGMP, r - Repeater
Device ID Local Intrfce Holdtme Capability Platform Port ID
Switch2 Fas 0/1 178 S I WS-CE500- Gig 2
R1#
This shows R1 connected to switch 2 - switch2 to is uplinked to Switch which R2 shows as a CDP neighbor, so I think that is working. R2 and R3 both show each other - this is a fiber connection between the two buildings about two miles apart that goes through AT&T network - What I don't understand is why the routers don't show any output when debug ospf commands are used. Could it be that ospf is not working?
Looks like physical connectivity is fine.
I'd like to see the route table from R1
show ip route
You should be able to see something with debug.
I'd like to see the route table from R1
show ip route
You should be able to see something with debug.
ASKER
R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.100.253 to network 0.0.0.0
C 192.168.10.0/24 is directly connected, FastEthernet0/1
C 192.168.100.0/24 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [120/0] via 192.168.100.253
R1#
R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.10.1 to network 0.0.0.0
C 192.168.10.0/24 is directly connected, FastEthernet0/0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [120/0] via 192.168.10.1
R2#
R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0.2 to network 0.0.0.0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [120/0] via 10.0.0.2
R3#
R3 only shows the 10.x.x.x because the building hasn't had any equipment moved in to it yet, so the 192.168.30.254 interface doesn't have anything plugged in.
I ran debug all on all three routers and let it sit for 5 minutes and there is nothing that comes up. I know this could have a large affect on the network, but there is nothing. Could it be that the routers are bad? There is no debug information from any router.
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.100.253 to network 0.0.0.0
C 192.168.10.0/24 is directly connected, FastEthernet0/1
C 192.168.100.0/24 is directly connected, FastEthernet0/0
S* 0.0.0.0/0 [120/0] via 192.168.100.253
R1#
R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.10.1 to network 0.0.0.0
C 192.168.10.0/24 is directly connected, FastEthernet0/0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [120/0] via 192.168.10.1
R2#
R3#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0.2 to network 0.0.0.0
10.0.0.0/24 is subnetted, 1 subnets
C 10.0.0.0 is directly connected, FastEthernet0/1
S* 0.0.0.0/0 [120/0] via 10.0.0.2
R3#
R3 only shows the 10.x.x.x because the building hasn't had any equipment moved in to it yet, so the 192.168.30.254 interface doesn't have anything plugged in.
I ran debug all on all three routers and let it sit for 5 minutes and there is nothing that comes up. I know this could have a large affect on the network, but there is nothing. Could it be that the routers are bad? There is no debug information from any router.
ASKER
Should I try a different routing protocol?
>so the 192.168.30.254 interface doesn't have anything plugged in.
Plug something in, anything just to bring up the interface and see if R1 learns about 192.168.30.0
If it does, then that's all you need.
You might try adding to R2
router ospf1
redist connected subnets <-- this should redistribute the 10.0.0.0 network to R1 and ASA
What do you see from show route on ASA? Does it learn anything OSPF?
Plug something in, anything just to bring up the interface and see if R1 learns about 192.168.30.0
If it does, then that's all you need.
You might try adding to R2
router ospf1
redist connected subnets <-- this should redistribute the 10.0.0.0 network to R1 and ASA
What do you see from show route on ASA? Does it learn anything OSPF?
ASKER
I will have to plug something in tomorrow on that network, can't get in the building tonight. Here is some output from the asa. No routes from ospf here but a debug ospf events gives an error. see below
ciscoasa# sh route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 12.53.216.65 to network 0.0.0.0
C 127.1.0.0 255.255.0.0 is directly connected, _internal_loopback
S 192.168.20.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 12.53.216.64 255.255.255.224 is directly connected, outside
S 192.168.2.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 192.168.100.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 12.53.216.65, outside
ciscoasa# debug ospf event
OSPF events debugging is on
ciscoasa#
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2
OSPF: Send with youngest Key 1
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2no debug all
ciscoasa#
ciscoasa# sh route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 12.53.216.65 to network 0.0.0.0
C 127.1.0.0 255.255.0.0 is directly connected, _internal_loopback
S 192.168.20.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 12.53.216.64 255.255.255.224 is directly connected, outside
S 192.168.2.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 192.168.100.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 12.53.216.65, outside
ciscoasa# debug ospf event
OSPF events debugging is on
ciscoasa#
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2
OSPF: Send with youngest Key 1
OSPF: Rcv pkt from 192.168.100.254, inside : Mismatch Authentication type. Input
packet specified type 0, we use type 2no debug all
ciscoasa#
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
that got a route on the ASA
ciscoasa# sh route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 12.53.216.65 to network 0.0.0.0
O IA 192.168.10.0 255.255.255.0 [110/11] via 192.168.100.254, 0:00:17, inside
C 127.1.0.0 255.255.0.0 is directly connected, _internal_loopback
S 192.168.20.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 12.53.216.64 255.255.255.224 is directly connected, outside
S 192.168.2.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 192.168.100.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 12.53.216.65, outside
ciscoasa#
I tried to use
router ospf1
redist connected subnets
in R1 as well to see if the connected route would popluate, but did not. I will get the inside port up on R3 today.
ciscoasa# sh route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 12.53.216.65 to network 0.0.0.0
O IA 192.168.10.0 255.255.255.0 [110/11] via 192.168.100.254, 0:00:17, inside
C 127.1.0.0 255.255.0.0 is directly connected, _internal_loopback
S 192.168.20.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 12.53.216.64 255.255.255.224 is directly connected, outside
S 192.168.2.0 255.255.255.0 [1/0] via 12.53.216.65, outside
C 192.168.100.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via 12.53.216.65, outside
ciscoasa#
I tried to use
router ospf1
redist connected subnets
in R1 as well to see if the connected route would popluate, but did not. I will get the inside port up on R3 today.
So, ospf is working!
ASKER
It looks that way.
I still can not ping past R2 from R3, but I am going to get that subnet up today and see if that corrects the problem.
I will let you know.
I still can not ping past R2 from R3, but I am going to get that subnet up today and see if that corrects the problem.
I will let you know.
ASKER
I am sorry, I told someone else to go over and plug something in, but it appears that they didn't make it over there today. I will know more in the morning.
ASKER
something still doesn't look right between R1 and R2. If I sh ip ospf data on R1, it shows the 192.168.100.x and 192.168.10.x which are on both sides of the router - makes sence.
on R2, it only shows the 10.0.0.x subnet, which is only the back side of the router and doesn't show the 192.168.10.x which I would expect.
Any ideas?
R1#sh ip ospf data
OSPF Router with ID (192.168.100.254) (Process ID 1)
Router Link States (Area 0)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.253 192.168.100.253 573 0x80000054 0x007036 1
192.168.100.254 192.168.100.254 1692 0x80000054 0x00D4D4 1
Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
192.168.100.254 192.168.100.254 442 0x8000001A 0x00E509
Summary Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
192.168.10.0 192.168.100.254 1692 0x80000053 0x000A9F
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.254 192.168.100.254 1692 0x80000058 0x007D4D 1
Summary Net Link States (Area 10)
Link ID ADV Router Age Seq# Checksum
192.168.100.0 192.168.100.254 442 0x80000055 0x002429
R2#sh ip ospf data
OSPF Router with ID (10.0.0.2) (Process ID 1)
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
10.0.0.2 10.0.0.2 121 0x80000058 0x00F7D9 0
Type-5 AS External Link States
Link ID ADV Router Age Seq# Checksum Tag
10.0.0.0 10.0.0.2 121 0x80000054 0x0058DE 0
on R2, it only shows the 10.0.0.x subnet, which is only the back side of the router and doesn't show the 192.168.10.x which I would expect.
Any ideas?
R1#sh ip ospf data
OSPF Router with ID (192.168.100.254) (Process ID 1)
Router Link States (Area 0)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.253 192.168.100.253 573 0x80000054 0x007036 1
192.168.100.254 192.168.100.254 1692 0x80000054 0x00D4D4 1
Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
192.168.100.254 192.168.100.254 442 0x8000001A 0x00E509
Summary Net Link States (Area 0)
Link ID ADV Router Age Seq# Checksum
192.168.10.0 192.168.100.254 1692 0x80000053 0x000A9F
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
192.168.100.254 192.168.100.254 1692 0x80000058 0x007D4D 1
Summary Net Link States (Area 10)
Link ID ADV Router Age Seq# Checksum
192.168.100.0 192.168.100.254 442 0x80000055 0x002429
R2#sh ip ospf data
OSPF Router with ID (10.0.0.2) (Process ID 1)
Router Link States (Area 10)
Link ID ADV Router Age Seq# Checksum Link count
10.0.0.2 10.0.0.2 121 0x80000058 0x00F7D9 0
Type-5 AS External Link States
Link ID ADV Router Age Seq# Checksum Tag
10.0.0.0 10.0.0.2 121 0x80000054 0x0058DE 0
ASKER
I take that back. I removed the network statement and re-added and now on R2 I am getting an ospf route as well.