Redistributing a route for a NATED subnet via eigrp/ospf

Posted on 2015-02-04
Medium Priority
Last Modified: 2015-02-09

I am using a Cisco ASA5505 version 9.2 and here's my problem

The ASA5505 is connected to 3 networks

outside: vlan lan trunk to multiple networks

NATED adresses: ( to to servers in the subnet

I need to advertise via eigrp and ospf on the outside interface the network.
I cannot create a loopback on the ASA it's not supported

How can I achieve this ?
Question by:fox54
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
LVL 31

Expert Comment

ID: 40590462
You should be able to create static routes and advertise/redistribute them over ospf and eigrp.
You need to create routes to interfaces (not to next hop address) -  this is also considered a connected route.


    ip route eth0/0

    router eigrp 1
     no auto-summary

    router ospf 1
    redistribute static metric xxx subnets
LVL 11

Expert Comment

ID: 40590581
So, your outside interface is "trunked" to another device and is one of the subinterfaces on the trunk? What is the IP address of that interface carrying the Can you use an address in the range for the interface? If you can, then all you have to do is advertize the via either EIGRP or OSPF network statement.

Author Comment

ID: 40590971

For routing to interface=Not supported on ASA

No I cannot use the IP on the outside interface itself.  This will clarify the whole configuration.  Forget the network.  It's the netwotk that I need to advertise NATED to some host in the subnet

Here's the actual configuration and route of the outside interface:

The outside interface in is trunk mode allowing VLAN 10 and 20 directly connected, Vlan10 directly connetced, VLAN10 directly connected, Vlan20 direcltly connected, VLAN20
101.1.12 directly connected, VLAN20 255.2552.255.0 is directly connected, inside is directly conected, inside is direclty connected, DMZ is directcly connected, DMZ
x.x.x.x.x via, VLAN10
y.y.y.y.y via VLAN10
and so on

I cannot connect the directly.  It needs to be NATED to some hosts on the subnet .
And I must advertise the via eigrp/ospf so the others networks reachable on the outside interface can connect to it.
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

LVL 31

Expert Comment

ID: 40591009
Yes, you're right .. all configure examples are here
ASA 9.2
Configuring static route
Redistribute static routes into ospf
Redistribute static routes into eigrp

Author Comment

ID: 40591187
Yes seems that it helps a little but I am not really sure how to implement it

What is the static route that I need to define for the ?  What would be the interface and the Gateway address ?

It has to be advertised on the VLAN10 and VLAN 20
LVL 11

Expert Comment

ID: 40592604
Can you post the output for each one of these commands? Don't edit anything.

sh run interface
sh run route
sh run router

You may have to put a router in front of the ASA.

Author Comment

ID: 40593025

It's a lab test (before installation).  I cannot give you the full output.

There's a Cisco 1811 connected to the outside interface of the ASA5505.  The router is advertising  routes to some other networks connected to it's 8 interfaces

Here's an edited example

interface Ethernet0/0
 switchport trunk allowed vlan 10,20
 switchport mode trunk

interface Vlan10
  nameif  External-Network_VLAN10
 security-level 100
 ip address
interface Vlan20
  nameif External-Network_VLAN20
 security-level 100
 ip address

I configured a static route for my NATED range

route External-Network_VLAN10

This point the route to the IP of VLAN10 of the Cisco 1811 connected to the outside interface of the ASA.
It's works.  but I also tried to add the route like this:

route External-Network_VLAN20
This point the route to the IP of VLAN20 of the Cisco 1811 connected to the outside interface of the ASA.

Both scenario works !.  Route for my NATED is redistributed and connectivity is established with my host behind the NAT

I found that weird that either route I added did the job. Am I missing something ?
LVL 11

Accepted Solution

naderz earned 2000 total points
ID: 40594772
No, actually you are not missing anything! It's just that ASA/Firewalls are not intended for this type of scenario and you usually see a router in front of the firewall taking care of this.

What you have noticed, and made work, is the fact that a route will not be advertized in a routing protocol (e.g. EIGRP or OSPF) if that route does not exist in the device's routing table (in this case the ASA).

By placing the static route (usually using routers this is done by static to null0; ASAs cannot do that) you have effectively placed the route in the routing table used by the ASA and therefore it will be advertized via EIGRP/OSPF.

Nice challenge!

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question