ASA prefer EIGRP over VPN?

Unanswered Question
Sep 8th, 2009

I'm running 8.2 code. I'd like to have an EIGRP learned path take precedence over a backup VPN tunnel between two sites.

I ran into problems that seemed to be due to the L2L network on the VPN getting injected into the routing table as a static route. At least I think that was the source of my trouble.

Any suggestions?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
sbrooke Tue, 09/08/2009 - 06:36

No redistribution on the ASA. Just a network statement for the Ethernet segment the EIGRP Neighbors are on.

Is it as simple as that? Something so obvious. I'm feeling kind of dense now.

Ok, so if the red conn is in there do the other routes still take precedence over the L2L VPN? After all, the red conn is only for local.

I've asked around about this but have yet to see something clearly defined. What's the order of operation for a packet when it hits the ASA? Sure would be nice if something clearly defined the order in which packets are processed. ie, inbound ACL, NAT, routing table, VPN ACL, outbound ACL...etc. That's probably wrong.

Collin Clark Tue, 09/08/2009 - 06:51

What you need to check is your routing. Which route is preferred? Is the other a FS? I don't know your setup but can you add delay to the link to the ASA? Can you increase the BW statement on the P2P link?

sbrooke Tue, 09/08/2009 - 06:58

The internal EIGRP path is effectively an Ethernet connection between sites. I would expect the metrics to look pretty good on that already.

I have a concern that the VPN is putting a route in with an admin distance of 1 and the EIGRP will never get over that.

Unfortunately I'm not able to test right now since this is in production.

Actions

This Discussion