k-melton wrote:
Jon
I wanted to give you a quick status update of the progress we have made at the client site today.
One at a time, and while using a console connection on each box I was removing a static route from in additon to SSH from the inside network, I was able to remove the static. At each device once the static was removed, EIGRP would install the 0 route, and the message about it being "inaccessible" would dissapear. Once again I appreciate your testing it in your lab, as this gave me a high confidence level while moving in that direction here. Here are the outputs of the respective devices starting at the Border Router.
For testing I was going to disconnect the Ethernet connection to the ISP. I think you had tested this before (or did you shut down the interface?) and replied that the result was the the Static route was removed. Once that kink is worked out, I think we are golden here.
I am wondering if I need to use IP SLA to monitor the ISP's gateway. We had discussed this at some point in the past, and I had configured it to some extent. Here is the output from the IP SLA configuration on the Border router. the address being monitored is the ISP GW.
bhigw2#sho run | beg ip sla
ip sla monitor 1
type echo protocol ipIcmpEcho 209.145.88.29
frequency 30
ip sla monitor schedule 1 life forever start-time now
bhigw2# sho ip sla monitor collection
Entry number: 1
Start Time Index: 11:05:01.955 Eastern Fri Jan 29 2010
Number of successful operations: 120
Number of operations over threshold: 0
Number of failed operations due to a Disconnect: 0
Number of failed operations due to a Timeout: 0
Number of failed operations due to a Busy: 0
Number of failed operations due to a No Connection: 0
Number of failed operations due to an Internal Error: 0
Number of failed operations due to a Sequence Error: 0
Number of failed operations due to a Verify Error: 0
RTT Values:
RTTAvg: 6 RTTMin: 1 RTTMax: 231
NumOfRTT: 120 RTTSum: 722 RTTSum2: 101810
Start Time Index: 12:05:01.955 Eastern Fri Jan 29 2010
Number of successful operations: 44
Number of operations over threshold: 0
Number of failed operations due to a Disconnect: 0
Number of failed operations due to a Timeout: 0
Number of failed operations due to a Busy: 0
Number of failed operations due to a No Connection: 0
Number of failed operations due to an Internal Error: 0
Number of failed operations due to a Sequence Error: 0
Number of failed operations due to a Verify Error: 0
RTT Values:
RTTAvg: 5 RTTMin: 1 RTTMax: 219
NumOfRTT: 45 RTTSum: 266 RTTSum2: 48020
I am still not sure of how to tie this in with the Static route or if I even need to. Thoughts?
Thx John
Kevin
Kevin
Really glad to see you making progress on this.
As for tracking the ISP next-hop, what type of connectivity are you using to connect to the ISP ? If it was serial for example you wouldn't need to track it but if ethernet you will do.
You can tie in IP SLA with object-tracking which allows you to remove a route from the routing table and insert another one. What we don't really need to do is insert a new one, we just want to remove the default-route if the ISP end goes down. We may need to insert a dummy route though just because that's the way it works - more testing for me i think.
There are a number of approaches to this -
1) if serial connectivity no IP SLA - we are fine
2) if ethernet then we could use IP SLA with object-tracking. If we have to insert another route when we remove the default route we can simply use a dummy route. An additional fail safe would be to use a route-map when we redistribute the statics into EIGRP on the border router. We only allow the default route to be redistributed so whatever dummy route we added would not be redistributed to your ASA.
So couple of questions need answering
1) serial or ethernet
2) are you redistributing only the default route on the border router into EIGRP or are there others
3) Do you use a routing protocol between the border router and the ISP router. I'm guessing no but just wanted to confirm. This is yet another approach we could use ie. peer with the ISP using BGP for example and accept just a default-route off them. You then don't need to have a static route configured on the border router because you are getting it off the ISP. You simply redistribute BGP into EIGRP - that would be why you only want the default route off the ISP and not the full internet routing table.
If the ISP link goes down then they will no longer be sending you a default route which means it will no longer be in the routing table and hence won't be sent to the ASA.
As you can see there are a number of ways of doing it. BGP might be overkill with your ISP for this type of connection and the IP SLA might be a better approach.
Happy to test it for you but first if you could answer questions as we may not need to.
Jon
