Solved

rri question as a follow up on Q_26409434

Posted on 2010-08-18
4
497 Views
Last Modified: 2012-05-10
from http://www.experts-exchange.com/Security/Software_Firewalls/Enterprise_Firewalls/Cisco_PIX_Firewall/Q_26409434.html?cid=1332#a33465386

how does RRI work with dynamic clients like easyvpn with the routing tables on both the local and remote endpoints?

does the hub wait for the connection before adding the route to its table or does only the client wait to populate the routing table?

thanks in advance!

-t
0
Comment
Question by:decoleur
  • 3
4 Comments
 
LVL 17

Expert Comment

by:Kvistofta
ID: 33466471
I am actually not sure about if RRI is needed at hub-end when running ezvpn in NEM. When you use client-mode it is exactly the same as a software vpn-client but with NEM there is actually a remote network that should be routable.

But this question is very academic. All implementations of ezvpn that I have ever seen has been over internet. That means that the ASA has a default route pointing towards internet and all internal routers has a default route to the ASA. In these cases you dont have to care about RRI.

But I will try this out within a few days. Please hold this question open and I will get back to you with more information. I will set it up in my lab environment.

/Kvistofta
0
 
LVL 17

Accepted Solution

by:
Kvistofta earned 500 total points
ID: 33467880
Hi again

I had a look at it. When using easyvpn, the different from "static vpn" is that you use a dynamic crypto-map. In there you can set reverse-route just like you do in a static crypto map entry. What happens in a dynamic-map with reverse-route is that the remote endpoint is inserted in the routing-table at the headend upon connection just as you mentioned. If you run client mode each client ip address is added with a /32 netmask (which could quite easily build a big routing table!) and in NEM the remote network is added when connected. For NEM it is the only option since the ip addressing of the remote network is not pre-configured in the hub firewall. It simply doesnt know in advance which remote network will connect in the future. When the session is torn down the route is removed from the routing table.

But again. This is quite rare circumstances. You almost ALWAYS have a default route pointing out to the internet. Only reason I can see is that you have a supernet-route of rfc1918-addresses pointing inwards (like 10.0.0.0/8) and the vpn remote network (or client pool) is a subset of this. Then you need RRI.

Does this answer your questions?

/Kvistofta
0
 
LVL 18

Author Closing Comment

by:decoleur
ID: 33468001
This is what I thought, thanks for looking at it.
0
 
LVL 17

Expert Comment

by:Kvistofta
ID: 33468048
You are welcome. :-)

/Kvistofta
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Set up wireless network on Cisco ASA 5505 with DHCP 13 51
Botnet detection help me please 21 83
Cisco Prime and Maps 3 35
Website Issue 10 63
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

25 Experts available now in Live!

Get 1:1 Help Now