ASA prefer EIGRP over VPN?

Unanswered Question
Sep 8th, 2009
User Badges:

I'm running 8.2 code. I'd like to have an EIGRP learned path take precedence over a backup VPN tunnel between two sites.

I ran into problems that seemed to be due to the L2L network on the VPN getting injected into the routing table as a static route. At least I think that was the source of my trouble.

Any suggestions?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Collin Clark Tue, 09/08/2009 - 06:21
User Badges:
  • Purple, 4500 points or more

Are you redistributing connected on the ASA?

sbrooke Tue, 09/08/2009 - 06:36
User Badges:

No redistribution on the ASA. Just a network statement for the Ethernet segment the EIGRP Neighbors are on.

Is it as simple as that? Something so obvious. I'm feeling kind of dense now.

Ok, so if the red conn is in there do the other routes still take precedence over the L2L VPN? After all, the red conn is only for local.

I've asked around about this but have yet to see something clearly defined. What's the order of operation for a packet when it hits the ASA? Sure would be nice if something clearly defined the order in which packets are processed. ie, inbound ACL, NAT, routing table, VPN ACL, outbound ACL...etc. That's probably wrong.

Collin Clark Tue, 09/08/2009 - 06:51
User Badges:
  • Purple, 4500 points or more

What you need to check is your routing. Which route is preferred? Is the other a FS? I don't know your setup but can you add delay to the link to the ASA? Can you increase the BW statement on the P2P link?

sbrooke Tue, 09/08/2009 - 06:58
User Badges:

The internal EIGRP path is effectively an Ethernet connection between sites. I would expect the metrics to look pretty good on that already.

I have a concern that the VPN is putting a route in with an admin distance of 1 and the EIGRP will never get over that.

Unfortunately I'm not able to test right now since this is in production.

Collin Clark Tue, 09/08/2009 - 07:00
User Badges:
  • Purple, 4500 points or more

Check the link above, you can set the admin distance.


This Discussion