PIX advertising EIGRP backup route

julianunderwood · ‎11-15-2008

Hi,

I will have a PIX with OS8 installed on it serving default route to the internet. Is it possible to bring up a tunnel on the PIX to a backup network and then advertise that route via EIGRP to a 1750 series router acting as the clients default gateway?

Then depending on metrics with EIGRP the client could be routed to the backup network via the tunnel on the PIX?

Regards,

Julian

Giuseppe Larosa · ‎11-16-2008

Hello Julian,

even in release 8.0 EIGRP is not supported on PIX.

IP Routing Support

The security appliance acts as a router between connected networks, and each interface requires an IP address on a different subnet. In single context mode, the routed firewall supports OSPF and RIP. Multiple context mode supports static routes only. We recommend using the advanced routing capabilities of the upstream and downstream routers instead of relying on the security appliance for extensive routing needs.

see

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/fwmode.html#wp1202235

You have to think to use OSPF instead or RIPv2.

Hope to help

Giuseppe

julianunderwood · ‎11-16-2008

Hi there,

I'm a little confused because according to:

PIX/ASA 8.X: Configuring EIGRP on the Cisco Adaptive Security Appliance (ASA)

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008086ebd2.shtml

Or is the EIGRP process crippled?

What I don't understand is will the PIX actually participate in EIGRP/OSPF/RIP fully and be able to advertise a route which will be usable through the PIX? (i.e. a backup route though a VPN tunnel). Or am I better off using OSPF/RIP on the PIX?

Thanks for your response.

Julian

Giuseppe Larosa · ‎11-17-2008

Hello Julian,

I've given a look at the link you have provided.

in OS 8.0.2 or later EIGRP should be supported.

Sorry for my misleading post but I had never heard or EIGRP support on PIX and tried to look at 8.0 configuration guide.

In general, if there is support for EIGRP it is a full support otherwise it would be stated something like EIGRP stub support (for the stub feature)

Hope to help

Giuseppe