How to Cisco Route-MAP Loopback IPA into OSPF.

Cannot Route-MAP Loopback IPA into OSPF.

Setting static routes I'm able to ping from a PC to IP Address (IPA) 192.168.100.7.  I would like to have IPA 192.168.100.7 distributed via OSPF to illminate static routes.

I've attempted to use Extended ACL but have failed.
Trouble-Shooting.vsd
James_HollomanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JustInCaseCommented:
You can redistribute static route into OSPF. If it is the only static route present there is no need to filer routers during redistribution.
router ospf 1
 redistribute static subnet

Open in new window

0
James_HollomanAuthor Commented:
Unfortunaetly there are multiple static routes on the Gateway Router as it faces outside our network so I can't redistribute the subnet.
0
JustInCaseCommented:
You can still redistribute, but, in that case, you need to filter static redistribution.
router ospf 1
 redistribute static subnets route-map REDIST_STAT

Open in new window

And create REDIST_STAT route-map to redistribute only route that you want to advertise.
0
Choose an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

James_HollomanAuthor Commented:
So on the outer router I did the following:
ip access-list extended GW_Loopback_IPA
permit ip 192.168.100.7 0.0.0.0 any log
deny ip any any log
deny tcp any any log
deny udp any any log

router ospf 1
 redistribute static subnets route-map GW_Loopback_IPA

Went to the internal Router.
typed:
sho ip route

Display shows as follows (editied):
O     192.168.100.6 [110/2] via 192.168.2.246, 2wod, GigabitEthernet0/0/1
S     192.168.100.7  [1/0] via 192.168.2.24
O     192.168.100.8 [110/67] via 192.168.3.1, 3d02h, GigabitEthernet0/0/3
                                  [110/67] via 192.168.1,150 3d02h, GigabitEthernet0/0/0

I'm still not able to ping from workstation 192.168.1.34.
0
JustInCaseCommented:
Route filtering is not properly implemented, here is configuration:
router ospf 1
 redistribute static subnets route-map GW_Loopback_IPA
!
ip prefix-list FILTER permit 192.168.100.7/32
!
route-map GW_Loopback_IPA permit 10
 match ip address prefix-list FILTER

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
James_HollomanAuthor Commented:
Predrag Jovic,
I've added the information (slightly modified)

router ospf 1
 redistribute static subnets route-map GW_Loopback_IPA

ip prefix-list GW_Loopback_Filter permit 192.168.100.7/32

route-map GW_Loopback_IPA permit 10
 match ip address prefix-list GW_Loopback_Filter

Initially I can ping from Workstation 192.68.1.32 to 192.168.100.7.  After about 3 minutes I am not able to ping the address.
As this is a NAT router is it possilbe that the NAT and NAT Pool EACL are affecting this?

NAT is set as followed:

ip access-list extended NAT
deny udp host 192.168.1.2 eq domain host 192.168.1.142 log
deny udp host 192.168.1.3 eq domain host 192.168.1.142 log
deny icmp host 192.168.1.2 host 192.168.1.142 log
deny icmp host 192.168.1.3 host 192.168.1.142 log
permit ip any any

ip nat pool External 192.168.236.137 192.168.236.137 netmask 255.255.248
ip nat inside source list NAT pool External overload

Show ip route display shows the same (editied):
O     192.168.100.6 [110/2] via 192.168.2.246, 16:59:20, GigabitEthernet0/0/1
S     192.168.100.7  [1/0] via 192.168.2.24
O     192.168.100.8 [110/67] via 192.168.3.1, 16:59:20, GigabitEthernet0/0/3
                                  [110/67] via 192.168.1.150, 16:59:40, GigabitEthernet0/0/0
0
JustInCaseCommented:
On local device static route should be present in routing table (since it has better administrative distance (AD)). If route is redistributed properly on device where route is redistributed should be visible in OSPF database (as external route).
sh ip ospf database

I don't know what can be issue, since I see only portion of configuration of one device.
And, generally, permit ip any any is not allowed/supported in new IOS versions for nat access-list, so you should replace that statement in NAT ACL with more specific statements.
0
James_HollomanAuthor Commented:
When I issue the sho ip ospf database on the internal router it states the following:
Type-5 As External Link States
Link ID = 192.168.100.7
ADV Router = 192.168.100.6
Age=1978
Seq#= 0x800000D8
Checksum=0x00536
Tag=0

show ip route shows that 100.7 is (S) Static.
The Internal Router is directly connected to the NAT Router.

On additonal Internal Routers that are not directly connected, the sho ip ospf database displays the following:
Type-5 As External Link States
Link ID = 192.168.100.7
ADV Router = 192.168.100.6
Age=192
Seq#= 0x800000D8
Checksum=0x000337
Tag=0

sho ip route does is listed as O E2 192.168.100.7 [110/20] via 192.168.2.XXX


I am to assume that it is now showing in OSPF based on the output of the OSPF Database (show ip ospf database).
0
JustInCaseCommented:
That is how it supposed to look like. Route is redistributed properly.
0
James_HollomanAuthor Commented:
I'm seeing the OSPF change on my multiple routers througout my network but am still unable to ping the IPA 192.168.100.7 via multiple remote networks even though I can see the IPA being routed in OSPF.
0
JustInCaseCommented:
Option 1:
router where 192.168.100.7 is located does not have knowledge about source networks in routing tables (ping are reaching interface 192.168.100.7, but icmp replay is dropped or sent to WAN (best matching route is default route))
Option 2:
some device between devices is dropping pings (ACL, firewall), traffic is not natted (and router does not have return route)

issue on  router that is redistributing static
debug ip icmp
to check if pings are reaching interface.

to remove debugging issue:
u all

That should provide you more information.
0
James_HollomanAuthor Commented:
So I believe we are getting somewhere now.
When I ping from IPA 192.168.1.32 --> 192.168.100.7 I see no ICMP packets being caught in the debug which indicates it is not passing through the NAT router.

When I ping from IPA 192.168.100.19 --> 192.168.100.7 I see ICMP packets being caught in the debug with a value of:
ICMP: echo reply sent, src 192.168.100.7, dst 192.168.236.137 (NAT IPA), topology BASE, dscp 0 topoid 0

I then ping again from IPA 192.168.1.32 --> 192.168.100.7 I see ICMP packets being caught in the debug with a value of:
ICMP: echo reply sent, src 192.168.236.142 (GIG 0.0 NAT Router), dst 192.168.236.137 (NAT IPA), topology BASE, dscp 0 topoid 0

I believe it has something to do with NAT which is making it work then not work.
0
JustInCaseCommented:
Hi James. It's not that I don't want to help, but what we are discussing now is not in any way related to your original question.
Cannot Route-MAP Loopback IPA into OSPF.

Setting static routes I'm able to ping from a PC to IP Address (IPA) 192.168.100.7.  I would like to have IPA 192.168.100.7 distributed via OSPF to illminate static routes.

I've attempted to use Extended ACL but have failed.
Original issue is resolved and now we are discussing why ping is still not working, which that is, generally, unrelated to solving redistribution problem.

Related to your previous post:
- as long as pings are reaching 192.168.100.7 and icmp reply is sent - there should be no NAT issue. NAT issue would be present in the case that ping is present, but source network is unknown. That would mean that traffic was not natted and route to the source of ping is not present in the routing table of the destination router. Now, since route to network 192.168.100.7/32 is correctly redistributed into OSPF if there is no some other issue along the path from ping source to 192.168.100.7/32 there should be no reason for pings not to reach 192.168.100.7 (problem should only be return path to the ping source)..
0
James_HollomanAuthor Commented:
Thanks for you assistance.  I've opened a Tech Support case with Cisco to identify why the IPA is re-distributed into OSPF and the subnet not showing up in the routing table.
0
James_HollomanAuthor Commented:
router ospf 1
 redistribute static subnets route-map GW_Loopback_IPA
!
ip prefix-list FILTER permit 192.168.100.7/32
!
route-map GW_Loopback_IPA permit 10
 match ip address prefix-list FILTER
0
JustInCaseCommented:
You're welcome.
0
James_HollomanAuthor Commented:
Followup:

On the NAT Router I had to apply an additional lines:

router ospf 1
passive-interface default
no passive-interface GIG 0/0

Once this was applied it fixed all the remaining issues.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.