I'm hoping someone can help with a routing issue I have between a pair of Nexus 7000 switches and a Cisco ASA Firewall.
We have an MPLS WAN linking two sites but have created a backup VPN tunnel in case of failure. Last night there was a fialure but there were issues with routing. Below is the topography between the sites for the backup:
NX7K <-> ASA <-> INTERNET(VPN) <-> ASA <-> Cat6500
On the Cat6500 the summary subnet is 10.10.0.0/16 and on the NX7K is 10.20.0.0/16 (fakes). Under normal circumstances traffic will route over the MPLS using a route picked up via OSPF. I've added a static route at each end pointing to the ASA with a metric of 200 so it will be ignored. If the MPLS goes down the OSPF route disappears and so the static route appears.
On the Cat6500 side the routing works fie and traffic goes to the firewall and then over the VPN tunnel. However on the NX7K side traffic seems to get stuck in a loop between the NX7K and the ASA. When I checked the ASA on the NX7K side I could see it was picking up the OSPF route for the other side from the NX7K, which would explain the loop. When I check the ASA on the Cat6500 side I do not see the route to the other side, which is why there isn't a problem. The Cat6500 is definitely redistributing the static route but the ASA seems to be clever enough to ignore it. However, on the NX7K side it's not ignoring it which means we can't sent traffic over the tunnel.
What do I need to do to make the ASA ignore the redistributed static routes from the NX7K that point to it? Any help would be much appreciated!