02-24-2010 04:58 PM - edited 03-04-2019 07:37 AM
Greeting
I am trying to conf eigrp with unicast over a firewall:
outside router:
===========
router eigrp 1
network 10.0.0.0
neighbor 10.1.1.1 GigbitEthernet1/0/2
interface GigbitEthernet1/0/2
desc firewall out interface
ip address 10.2.1.1 255.255.255.0
firewall
======
the interface linked to outside router g1/0/2, is 10.2.1.2
the interface linked to inside roter, is 10.1.1.2
inside roter
==========
router eigrp 1
network 10.0.0.0
neigbor 10.2.1.1 GigbitEthernet1/0/2
interface Gigibit Ethernet1/0/2
desc firewall in interface
ip address 10.1.1.1 255.255.255.0
The outside router (it shold be same on insite router) do the first thing is to boardcast to find where is 10.1.1.1.
I can not let firewall pass boardcast, obviously.
Do I have any chance to let eigrp unicast over a firewall? I thought I did read something which said it is possible to do it.
Can anyone give me some tip? what I should do on firewall, and what I should do on routers?
Any comment will be appreciated
Thanks in advance
julxu
Solved! Go to Solution.
02-24-2010 05:15 PM
Hi,
It is possible that we can configure EIGRP in PIX/ASA. as you said the eigrp packets send to the neighbors via multicast packets.
SInce you want to configure EIGRP in PIX/ASA , it is possible that we can send EIGRP packets to the neighbors via unicast.
and moreover, you need to open the eigrp firewall policy in your firewall to send eigrp packets from your outside router to inside router and you need to do some changes in the firewall to send unicast packets.
from cisco webportal:
//
EIGRP hello packets are sent as multicast packets. If an EIGRP neighbor is located across a nonbroadcast network, you must manually define that neighbor. When you manually define an EIGRP neighbor, hello packets are sent to that neighbor as unicast messages. In order to define static EIGRP neighbors, go to the Static Neighbor pane.
By default, default routes are sent and accepted. In order to restrict or disable the sending and receiving of default route information, open the Configuration > Device Setup > Routing > EIGRP > Default Information pane. The Default Information pane displays a table of rules to control the sending and receiving of default route information in EIGRP updates
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008086ebd2.shtml
regards
karuppu
02-24-2010 05:32 PM
julxu wrote:
outside router:
===========
router eigrp 1
network 10.0.0.0
neighbor 10.1.1.1 GigbitEthernet1/0/2
interface GigbitEthernet1/0/2
desc firewall out interface
ip address 10.2.1.1 255.255.255.0
firewall
======
the interface linked to outside router g1/0/2, is 10.2.1.2
the interface linked to inside roter, is 10.1.1.2
inside roter
==========
router eigrp 1
network 10.0.0.0
neigbor 10.2.1.1 GigbitEthernet1/0/2
interface Gigibit Ethernet1/0/2
desc firewall in interface
ip address 10.1.1.1 255.255.255.0
This won't work as far as i know even with the neighbor command because EIGRP requires the 2 neighbor addresses to be on the same subnet and in your case they aren't.
You have a number of options if you want to run EIGRP between the 2 routers -
1) Use a GRE tunnel between the inside router and the outside router. This is not recommended as a firewall cannot inspect GRE traffic so it is just like drilling a hole in your firewall.
2) configure the firewall in transparent mode instead of routed mode. In transparent mode the 2 routers become L2 adjacent and you could use the same subnet for both router interfaces. This may or may not be an option depending on the rest of your firewall config.
3) If your firewall is a pix/ASA and it is running v8.x code or you can upgrade it to v8.x code then the firewall will be able to run EIGRP so your inside router would form a neighborship with the firewall and your outside router would form a neighborship with the firewall.
Traditionally BGP was the routing protocol of choice if you need to peer across a firewall because
1) BGP does not require that a neighbor is on the same subnet
2) BGP uses TCP for communication which a stateful firewall is ideally suited for
Jon
02-25-2010 05:37 PM
Hi,
I have image s72033-ipservicesk9_wan-mz.122, do I have license problem to use BGP? -- No problem.You can configure BGP on your routers,
This IOS will support to configure BGP.
And you need to open the firewall rule for BGP protocol communication and to make the neighborship between these routers in your FIrewall.
regards
karuppu
02-24-2010 05:15 PM
Hi,
It is possible that we can configure EIGRP in PIX/ASA. as you said the eigrp packets send to the neighbors via multicast packets.
SInce you want to configure EIGRP in PIX/ASA , it is possible that we can send EIGRP packets to the neighbors via unicast.
and moreover, you need to open the eigrp firewall policy in your firewall to send eigrp packets from your outside router to inside router and you need to do some changes in the firewall to send unicast packets.
from cisco webportal:
//
EIGRP hello packets are sent as multicast packets. If an EIGRP neighbor is located across a nonbroadcast network, you must manually define that neighbor. When you manually define an EIGRP neighbor, hello packets are sent to that neighbor as unicast messages. In order to define static EIGRP neighbors, go to the Static Neighbor pane.
By default, default routes are sent and accepted. In order to restrict or disable the sending and receiving of default route information, open the Configuration > Device Setup > Routing > EIGRP > Default Information pane. The Default Information pane displays a table of rules to control the sending and receiving of default route information in EIGRP updates
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008086ebd2.shtml
regards
karuppu
02-24-2010 05:32 PM
julxu wrote:
outside router:
===========
router eigrp 1
network 10.0.0.0
neighbor 10.1.1.1 GigbitEthernet1/0/2
interface GigbitEthernet1/0/2
desc firewall out interface
ip address 10.2.1.1 255.255.255.0
firewall
======
the interface linked to outside router g1/0/2, is 10.2.1.2
the interface linked to inside roter, is 10.1.1.2
inside roter
==========
router eigrp 1
network 10.0.0.0
neigbor 10.2.1.1 GigbitEthernet1/0/2
interface Gigibit Ethernet1/0/2
desc firewall in interface
ip address 10.1.1.1 255.255.255.0
This won't work as far as i know even with the neighbor command because EIGRP requires the 2 neighbor addresses to be on the same subnet and in your case they aren't.
You have a number of options if you want to run EIGRP between the 2 routers -
1) Use a GRE tunnel between the inside router and the outside router. This is not recommended as a firewall cannot inspect GRE traffic so it is just like drilling a hole in your firewall.
2) configure the firewall in transparent mode instead of routed mode. In transparent mode the 2 routers become L2 adjacent and you could use the same subnet for both router interfaces. This may or may not be an option depending on the rest of your firewall config.
3) If your firewall is a pix/ASA and it is running v8.x code or you can upgrade it to v8.x code then the firewall will be able to run EIGRP so your inside router would form a neighborship with the firewall and your outside router would form a neighborship with the firewall.
Traditionally BGP was the routing protocol of choice if you need to peer across a firewall because
1) BGP does not require that a neighbor is on the same subnet
2) BGP uses TCP for communication which a stateful firewall is ideally suited for
Jon
02-25-2010 05:06 PM
I have image s72033-ipservicesk9_wan-mz.122, do I have license problem to use BGP? please advice?
02-25-2010 05:37 PM
Hi,
I have image s72033-ipservicesk9_wan-mz.122, do I have license problem to use BGP? -- No problem.You can configure BGP on your routers,
This IOS will support to configure BGP.
And you need to open the firewall rule for BGP protocol communication and to make the neighborship between these routers in your FIrewall.
regards
karuppu
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: