Redistributing a route for a NATED subnet via eigrp/ospf

Posted on 2015-02-04
Last Modified: 2015-02-09

I am using a Cisco ASA5505 version 9.2 and here's my problem

The ASA5505 is connected to 3 networks

outside: vlan lan trunk to multiple networks

NATED adresses: ( to to servers in the subnet

I need to advertise via eigrp and ospf on the outside interface the network.
I cannot create a loopback on the ASA it's not supported

How can I achieve this ?
Question by:fox54
  • 3
  • 3
  • 2
LVL 27

Expert Comment

by:Predrag Jovic
ID: 40590462
You should be able to create static routes and advertise/redistribute them over ospf and eigrp.
You need to create routes to interfaces (not to next hop address) -  this is also considered a connected route.


    ip route eth0/0

    router eigrp 1
     no auto-summary

    router ospf 1
    redistribute static metric xxx subnets
LVL 11

Expert Comment

ID: 40590581
So, your outside interface is "trunked" to another device and is one of the subinterfaces on the trunk? What is the IP address of that interface carrying the Can you use an address in the range for the interface? If you can, then all you have to do is advertize the via either EIGRP or OSPF network statement.

Author Comment

ID: 40590971

For routing to interface=Not supported on ASA

No I cannot use the IP on the outside interface itself.  This will clarify the whole configuration.  Forget the network.  It's the netwotk that I need to advertise NATED to some host in the subnet

Here's the actual configuration and route of the outside interface:

The outside interface in is trunk mode allowing VLAN 10 and 20 directly connected, Vlan10 directly connetced, VLAN10 directly connected, Vlan20 direcltly connected, VLAN20
101.1.12 directly connected, VLAN20 255.2552.255.0 is directly connected, inside is directly conected, inside is direclty connected, DMZ is directcly connected, DMZ
x.x.x.x.x via, VLAN10
y.y.y.y.y via VLAN10
and so on

I cannot connect the directly.  It needs to be NATED to some hosts on the subnet .
And I must advertise the via eigrp/ospf so the others networks reachable on the outside interface can connect to it.
LVL 27

Expert Comment

by:Predrag Jovic
ID: 40591009
Yes, you're right .. all configure examples are here
ASA 9.2
Configuring static route
Redistribute static routes into ospf
Redistribute static routes into eigrp
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.


Author Comment

ID: 40591187
Yes seems that it helps a little but I am not really sure how to implement it

What is the static route that I need to define for the ?  What would be the interface and the Gateway address ?

It has to be advertised on the VLAN10 and VLAN 20
LVL 11

Expert Comment

ID: 40592604
Can you post the output for each one of these commands? Don't edit anything.

sh run interface
sh run route
sh run router

You may have to put a router in front of the ASA.

Author Comment

ID: 40593025

It's a lab test (before installation).  I cannot give you the full output.

There's a Cisco 1811 connected to the outside interface of the ASA5505.  The router is advertising  routes to some other networks connected to it's 8 interfaces

Here's an edited example

interface Ethernet0/0
 switchport trunk allowed vlan 10,20
 switchport mode trunk

interface Vlan10
  nameif  External-Network_VLAN10
 security-level 100
 ip address
interface Vlan20
  nameif External-Network_VLAN20
 security-level 100
 ip address

I configured a static route for my NATED range

route External-Network_VLAN10

This point the route to the IP of VLAN10 of the Cisco 1811 connected to the outside interface of the ASA.
It's works.  but I also tried to add the route like this:

route External-Network_VLAN20
This point the route to the IP of VLAN20 of the Cisco 1811 connected to the outside interface of the ASA.

Both scenario works !.  Route for my NATED is redistributed and connectivity is established with my host behind the NAT

I found that weird that either route I added did the job. Am I missing something ?
LVL 11

Accepted Solution

naderz earned 500 total points
ID: 40594772
No, actually you are not missing anything! It's just that ASA/Firewalls are not intended for this type of scenario and you usually see a router in front of the firewall taking care of this.

What you have noticed, and made work, is the fact that a route will not be advertized in a routing protocol (e.g. EIGRP or OSPF) if that route does not exist in the device's routing table (in this case the ASA).

By placing the static route (usually using routers this is done by static to null0; ASAs cannot do that) you have effectively placed the route in the routing table used by the ASA and therefore it will be advertized via EIGRP/OSPF.

Nice challenge!

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

930 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now