Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA prefer EIGRP over VPN?

I'm running 8.2 code. I'd like to have an EIGRP learned path take precedence over a backup VPN tunnel between two sites.

I ran into problems that seemed to be due to the L2L network on the VPN getting injected into the routing table as a static route. At least I think that was the source of my trouble.

Any suggestions?


Re: ASA prefer EIGRP over VPN?

Are you redistributing connected on the ASA?

New Member

Re: ASA prefer EIGRP over VPN?

No redistribution on the ASA. Just a network statement for the Ethernet segment the EIGRP Neighbors are on.

Is it as simple as that? Something so obvious. I'm feeling kind of dense now.

Ok, so if the red conn is in there do the other routes still take precedence over the L2L VPN? After all, the red conn is only for local.

I've asked around about this but have yet to see something clearly defined. What's the order of operation for a packet when it hits the ASA? Sure would be nice if something clearly defined the order in which packets are processed. ie, inbound ACL, NAT, routing table, VPN ACL, outbound ACL...etc. That's probably wrong.

Re: ASA prefer EIGRP over VPN?

What you need to check is your routing. Which route is preferred? Is the other a FS? I don't know your setup but can you add delay to the link to the ASA? Can you increase the BW statement on the P2P link?

Re: ASA prefer EIGRP over VPN?

I found a link on configuring EIGRP and setting the attributes.

You can increase the delay until the P2P is preferred.

New Member

Re: ASA prefer EIGRP over VPN?

The internal EIGRP path is effectively an Ethernet connection between sites. I would expect the metrics to look pretty good on that already.

I have a concern that the VPN is putting a route in with an admin distance of 1 and the EIGRP will never get over that.

Unfortunately I'm not able to test right now since this is in production.

Re: ASA prefer EIGRP over VPN?

Check the link above, you can set the admin distance.