Redistributing a route for a NATED subnet via eigrp/ospf


I am using a Cisco ASA5505 version 9.2 and here's my problem

The ASA5505 is connected to 3 networks

outside: vlan lan trunk to multiple networks

NATED adresses: ( to to servers in the subnet

I need to advertise via eigrp and ospf on the outside interface the network.
I cannot create a loopback on the ASA it's not supported

How can I achieve this ?
Who is Participating?
No, actually you are not missing anything! It's just that ASA/Firewalls are not intended for this type of scenario and you usually see a router in front of the firewall taking care of this.

What you have noticed, and made work, is the fact that a route will not be advertized in a routing protocol (e.g. EIGRP or OSPF) if that route does not exist in the device's routing table (in this case the ASA).

By placing the static route (usually using routers this is done by static to null0; ASAs cannot do that) you have effectively placed the route in the routing table used by the ASA and therefore it will be advertized via EIGRP/OSPF.

Nice challenge!
You should be able to create static routes and advertise/redistribute them over ospf and eigrp.
You need to create routes to interfaces (not to next hop address) -  this is also considered a connected route.


    ip route eth0/0

    router eigrp 1
     no auto-summary

    router ospf 1
    redistribute static metric xxx subnets
So, your outside interface is "trunked" to another device and is one of the subinterfaces on the trunk? What is the IP address of that interface carrying the Can you use an address in the range for the interface? If you can, then all you have to do is advertize the via either EIGRP or OSPF network statement.
Firewall Management 201 with Professor Wool

In this whiteboard video, Professor Wool highlights the challenges, benefits and trade-offs of utilizing zero-touch automation for security policy change management. Watch and Learn!

fox54Author Commented:

For routing to interface=Not supported on ASA

No I cannot use the IP on the outside interface itself.  This will clarify the whole configuration.  Forget the network.  It's the netwotk that I need to advertise NATED to some host in the subnet

Here's the actual configuration and route of the outside interface:

The outside interface in is trunk mode allowing VLAN 10 and 20 directly connected, Vlan10 directly connetced, VLAN10 directly connected, Vlan20 direcltly connected, VLAN20
101.1.12 directly connected, VLAN20 255.2552.255.0 is directly connected, inside is directly conected, inside is direclty connected, DMZ is directcly connected, DMZ
x.x.x.x.x via, VLAN10
y.y.y.y.y via VLAN10
and so on

I cannot connect the directly.  It needs to be NATED to some hosts on the subnet .
And I must advertise the via eigrp/ospf so the others networks reachable on the outside interface can connect to it.
Yes, you're right .. all configure examples are here
ASA 9.2
Configuring static route
Redistribute static routes into ospf
Redistribute static routes into eigrp
fox54Author Commented:
Yes seems that it helps a little but I am not really sure how to implement it

What is the static route that I need to define for the ?  What would be the interface and the Gateway address ?

It has to be advertised on the VLAN10 and VLAN 20
Can you post the output for each one of these commands? Don't edit anything.

sh run interface
sh run route
sh run router

You may have to put a router in front of the ASA.
fox54Author Commented:

It's a lab test (before installation).  I cannot give you the full output.

There's a Cisco 1811 connected to the outside interface of the ASA5505.  The router is advertising  routes to some other networks connected to it's 8 interfaces

Here's an edited example

interface Ethernet0/0
 switchport trunk allowed vlan 10,20
 switchport mode trunk

interface Vlan10
  nameif  External-Network_VLAN10
 security-level 100
 ip address
interface Vlan20
  nameif External-Network_VLAN20
 security-level 100
 ip address

I configured a static route for my NATED range

route External-Network_VLAN10

This point the route to the IP of VLAN10 of the Cisco 1811 connected to the outside interface of the ASA.
It's works.  but I also tried to add the route like this:

route External-Network_VLAN20
This point the route to the IP of VLAN20 of the Cisco 1811 connected to the outside interface of the ASA.

Both scenario works !.  Route for my NATED is redistributed and connectivity is established with my host behind the NAT

I found that weird that either route I added did the job. Am I missing something ?
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.