CCNP Security FIREWALL 642-618 Official Cert Guide (2012)

---

Routing with EIGRP

The Enhanced Interior Gateway Routing Protocol (EIGRP) uses a complex routing metric that is based on a combination of delay, bandwidth, reliability, load, and MTU. EIGRP combines the advantages of link-state and distance-vector routing protocols, making it a hybrid of both methods.

EIGRP uses a neighbor discovery mechanism that works by sending hello messages to directly connected neighboring routers. Neighbors can be dynamically discovered or statically configured. All EIGRP messages, including the hello protocol, are sent as multicast packets to address 224.0.0.10, the “all EIGRP routers” address, using IP protocol 88.

EIGRP supports variable-length subnet masks (VLSM) and route summarization, providing plenty of flexibility in its routing information. It also uses the Diffusing Update

Algorithm (DUAL) to compute and maintain routing information from all of its neighbors. The ASA (or any other EIGRP router) always uses a feasible successor or a neighboring router with the lowest cost path to a destination.

EIGRP routers do not send periodic routing updates. Rather, routing information is exchanged only when a route’s metric changes, based on information from neighboring routers. If you have routers running EIGRP in your network, you might want to run EIGRP on your ASA too, so that the ASA can benefit from dynamic routing information. Be aware that an ASA can run only one EIGRP process.

As an example, suppose that an ASA has its Ethernet0/0 interface facing the outside, public network, while Ethernet0/1 faces the inside, protected network, as shown in Figure 4-13. EIGRP is being used on the internal network, due to the network’s size. The ASA will participate in EIGRP so that it can receive dynamic updates about internal IP subnets.

Figure 4-13. Example EIGRP Scenario

Because the ASA has only a single path to the outside world, it can become an EIGRP stub router. As well, there is no need for the outside interface to participate in routing updates because there is no trusted EIGRP neighbor there.

To configure the example scenario using ASDM, navigate to Configuration > Device Setup > Routing > EIGRP. Begin with the Setup option, where you enable EIGRP and set the autonomous system number, as shown in Figure 4-14. EIGRP routers can exchange routing information if they each belong to the same autonomous system. Make sure the autonomous system number (1 to 65,535) matches that of other EIGRP routers in your network.

Figure 4-14. Configuring EIGRP Setup Parameters in ASDM

You can also click the Advanced button to configure autosummarization, set the default metric values, configure EIGRP stub routing, and tune the administrative distance.

Next, click the Networks tab within the Setup window and add any IP networks that will participate in EIGRP routing updates and which subnets to advertise, as shown in Figure 4-15.

Figure 4-15. Configuring EIGRP Networks in the ASDM EIGRP Setup

Next, click the Passive Interfaces tab to identify any EIGRP passive interfaces. The subnet on a passive interface will be advertised, but the interface will not participate in EIGRP routing exchanges In Figure 4-16, the outside interface is configured to be passive.

Figure 4-16. Configuring EIGRP Passive Interfaces in ASDM

To configure route filtering, choose Routing > EIGRP > Filter Rules and add any rules to a specific interface. Although route filtering is not used in the example scenario, the process is shown in Figure 4-17.

Figure 4-17. Configuring EIGRP Route Filtering in ASDM

Next, you can configure EIGRP authentication by choosing Routing > EIGRP > Interface, selecting an ASA interface, and then clicking Edit. You should always make sure that an ASA receives trusted routing information from neighboring routers by configuring MD5 authentication. Once authentication is enabled, any EIGRP neighbors that fail to present the correct key will be ignored. You can enable MD5 authentication and enter a key string and key identifier, as shown in Figure 4-18.

Figure 4-18. Configuring EIGRP Authentication in ASDM

An ASA can redistribute routes that it has learned from other sources into its EIGRP process. Directly connected and static routes, as well as routes learned from RIP or OSPF processes, can be redistributed. As a best practice, you should configure a route map to filter routing information from one routing protocol into EIGRP to prevent routing loops.

You should also define default metric values for all routes that are redistributed into EIGRP, because metrics from the different route sources are not equivalent. You can do this for each redistributed source or you can define a single set of default metrics for all sources that do not have explicit values defined.

To configure redistribution into EIGRP, navigate to Routing > EIGRP > Redistribution, click the Add button to add a routing source, and fill in the necessary parameters, as shown in Figure 4-19.

Figure 4-19. Configuring Route Redistribution into EIGRP from ASDM

You can configure any summary addresses by choosing Routing > EIGRP > Summary Address and then adding the network address, subnet mask, and interface, as shown in Figure 4-20. No summary addresses are used in the example scenario.

Figure 4-20. Configuring EIGRP Summary Addresses in ASDM

You can configure EIGRP with the CLI as well by using the following steps:

Step 1. Enable an EIGRP process:

ciscoasa(config)# router eigrp as-num

Step 2. Associate a network with the EIGRP process:

ciscoasa(config-router)# network ip-addr [mask]

EIGRP must know which interfaces will participate in routing updates and which interface subnets to advertise. If an interface address falls within the subnet ip-addr and mask, EIGRP will use it in its operation.

If you want the interface subnet to be advertised, but you don’t want the interface to participate in EIGRP routing exchanges, you can use the following command:

ciscoasa(config-router)# passive-interface interface

Step 3. Control route summarization.

By default, EIGRP will automatically summarize subnet routes into classful network routes when they are advertised. If you have contiguous subnets that are separated across ASA interfaces or across EIGRP routers, you should disable route summarization with the following EIGRP configuration command:

ciscoasa(config-router)# no auto-summary

Otherwise, you can configure a summary address that is advertised on a specific interface. This can be handy if you need a summary address that doesn’t fall cleanly within a network boundary. In addition, if you have already disabled automatic summarization, the firewall can still advertise a summary address that is manually configured. You can configure a summary address, the EIGRP autonomous system number, and an optional administrative distance, with the following commands:

ciscoasa(config)# interface interface
ciscoasa(config-if)# summary-address eigrp as-num address mask
[distance]

Step 4. Redistribute routing information from other sources.

To redistribute routes that were learned by RIP, that are statically defined, or that are directly connected, use the following EIGRP configuration command:

ciscoasa(config-router)# redistribute {rip | static
| connected} [metric bandwidth delay reliability load mtu]
[route-map map_name]

To redistribute routes learned from OSPF, use the following EIGRP configuration command:

ciscoasa(config-router)# redistribute ospf pid [match
{internal | external [1 | 2] | nssa-external [1 | 2]}]
[metric bandwidth delay reliability load mtu] [route-map map_name]

Identify the OSPF process as pid. You can match against OSPF internal, type 1 or 2 OSPF external, or external type 1 or 2 not-so-stubby area (nssa-external) routes.

You can define a set of default redistribution metric values with the following EIGRP configuration command:

ciscoasa(config-router)# default-metric bandwidth delay reliability
loading mtu

Specify the composite default metric as the combination of bandwidth (1 to 4,294,967,295 kbps), delay (1 to 4,294,967,295 in tens of microseconds), reliability (0 to 255, ranging from low to high), loading (1 to 255, ranging from low to high link usage), and mtu (1 to 65,535 bytes).

Step 5. Use stub routing for an ASA with a single exit point.

If the ASA has a single connection to the outside world through a neighboring router, it can become an EIGRP stub router. As a stub, it can receive routes (usually a default route) from its neighbor, but will advertise only specific routes of its own. The command syntax follows:

ciscoasa(config-router)# eigrp stub {receive-only | [connected]
[redistributed] [static] [summary]}

With the receive-only keyword, the ASA will receive updates but will not advertise anything; otherwise, you can specify one or more route types to advertise. Use the connected keyword to advertise routes that are directly connected to the ASA, the redistributed keyword to advertise any routes that the ASA has redistributed into its EIGRP process, the static keyword to advertise static routes defined on the ASA, or the summary keyword to advertise summary addresses defined on the ASA.

Step 6. Secure EIGRP updates with neighbor authentication.

You should always make sure that an ASA receives trusted routing information from neighboring routers by configuring MD5 authentication. EIGRP authentication is configured on a per-interface basis and must be associated with the EIGRP autonomous system number. Once authentication is enabled, any EIGRP neighbors that fail to present the correct key will be ignored. The command syntax follows:

ciscoasa(config)# interface interface
ciscoasa(config-if)# authentication mode eigrp as-num md5
ciscoasa(config-if)# authentication key eigrp as-num key-string
key-id key-id

Step 7. Optionally, filter EIGRP updates to suppress specific networks.

First, configure a standard access list that will permit only certain routes or subnets. Then, apply that access list to an EIGRP distribute list with the following EIGRP configuration command. The in keyword filters the routes as they are received from other EIGRP routers, whereas theout keyword filters the routes in EIGRP advertisements from the firewall. You can add the interface keyword to filter routes only on a specific interface:

ciscoasa(config-router)# distribute-list acl-id {in | out} [interface
interface]

To configure the ASA for EIGRP operation with the example scenario, you can use the commands listed in Example 4-6.

Example 4-6. Configuration Commands Used for EIGRP Scenario