Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Passing EIGRP through a PIX

Is it possible to pass EIGRP through a PIX. I know that the PIX will not pass multicast packets and EIGRP uses multicast. I have read that you can use the neighbor command on the routers to send unicast instead of multicast. If i set this up and permit eigrp on an access list on the PIX between the 2 routers will that allow the routing updates to occur between the 2 routers? In this scenario I would have one router on a DMZ interface and the other router on the inside interface.

Thanks

MIke

3 REPLIES

Re: Passing EIGRP through a PIX

Yes, you shoudl be able to do it (eigrp over pix). But not sure you would want to do it from a security point of view.

Although the neighbor command is accepted by the Cisco IOS under EIGRP, it should not be used. The neighbor statement does not behave as intended and can have a negative effect on EIGRP neighbors. See bug CSCdv19648 for more information.

The best way to accomplish this would be to set-up a GRE tunnel between the routers and open the PIX access-lists to allow gre between the routers.

eg.

hostname R1

!

interface Loopback0

ip address 10.1.1.1 255.255.255.0

!

interface Tunnel0

ip address 192.168.1.1 255.255.255.0

tunnel source Loopback0

tunnel destination 10.3.3.3

!

router eigrp 1

network 10.1.1.0 0.0.0.255

network 192.168.1.0

network y.y.y.y

no auto-summary

hostname R3

!

interface Loopback0

ip address 10.3.3.3 255.255.255.0

!

interface Tunnel0

ip address 192.168.1.3 255.255.255.0

tunnel source Loopback0

tunnel destination 10.1.1.1

!

router eigrp 1

network 10.3.3.0 0.0.0.255

network 192.168.1.0

network x.x.x.x

no auto-summary

The PIX would look something like this (minus the static/NAT/global commands):

access-list 101 permit gre host 10.3.3.3 host 10.1.1.1 (if no nat used, if nat used the nat'ed IP would be used instead of 10.1.1.1)

access-group 101 in interface outside

Hope it helps.

Steve

New Member

Re: Passing EIGRP through a PIX

Steve,

Would this work with RIPv2?

and ..

do you know if we can set up a GRE tunnel between Cisco and Bay networks?

thanks

Ken

Re: Passing EIGRP through a PIX

Yes it will work with RIPv2 as it uses a multicast address (224.0.0.9). And as for GRE between Cisco and Bay, sorry I have no idea, but I would guess yes as GRE uses protocol 47 (not proprietary to either company).

Steve

139
Views
0
Helpful
3
Replies