allow EIGRP through the PIX

jvhaysx · ‎10-07-2005

I have a customer who wants to allow EIGRP through the PIX. I have tried this in my lab (one router on PIX inside and another router on PIX outside) and can't get it to work. I also put the two routers on the same subnet (changed the IP address of one) and verified EIGRP was working correctly on each router.

Here's the relevant portions of the PIX config:

access-list outside permit icmp any any

access-list outside permit tcp any host 172.16.1.22 eq www

access-list outside permit eigrp any any

access-list outside permit ip any host 224.0.0.10

access-list inside permit ip any any

ip address outside 172.16.1.1 255.255.255.0

ip address inside 10.1.1.1 255.255.255.0

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) 172.16.1.22 10.1.1.2 netmask 255.255.255.255 0 0

static (inside,outside) 172.16.1.5 10.1.1.5 netmask 255.255.255.255 0 0

static (inside,outside) 224.0.0.10 224.0.0.10 netmask 255.255.255.255 0 0

access-group outside in interface outside

access-group inside in interface inside

I don't say this is a wise thing to do, I just want to know if it's possible. After all, the PIX accepts 'eigrp' as a keyword.

bobd · ‎10-07-2005

To permit outbound eigrp you will need to add

access-list inside permit eigrp any any

to establish the neighbors on seperate subnets, on the routers add the eigrp nieghbor command

neighbor x.x.x.x (the ip of the peer router)

note that using the neighbor command can cause some undesireable results by disabling the processing or sending of multicast packets on that eigrp interface. The last link below provide additional info on that.

http://www.cisco.com/en/US/customer/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a00800eb733.html

http://www.cisco.com/en/US/customer/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d02a.html#wp1076355

http://www.cisco.com/en/US/customer/tech/tk365/technologies_q_and_a_item09186a008012dac4.shtml