filtering EIGRP route advertisements

[tato386]

I have a router with 4 interfaces and EIGRP runs on all 4 interfaces.  I need all routes to be advertised on all interfaces except two /32 routes which I need to be advertised on just _one_ of the 4 interfaces.  I am looking for the cleanest, simplest way of doing this.  Here are more details:

S0: MPLS QoS Enabled WAN
S1: Primary WAN
S2: Backup WAN
G0: Local LAN (IP 1.1.1.254)

Local LAN subnet is 1.1.1.0/24

I need to advertise 1.1.1.11/32 and 1.1.1.12/32  _ONLY_ out of S0 interface. I figure first thing is I need to ge those

two /32 routes into the routing table.  I figure my options are:

ip route 1.1.1.11 255.255.255.255 1.1.1.254 or ip route 1.1.1.11 255.255.255.255 G0

I figure one would add the /32 as a static route and the other as a connected route.  That might make a difference on how I would proceed I think.

Next step would be to use ACL, route-map and EIGRP commands to do the actual filtering.  This is the part I would like to keep as clean an simple as possible.

Any ideas?  Am I going in the right direction?

Thanks,
Diego

[mfurnival]

You would control advertisement of specific subnets out of interface using distribute lists:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_eigrp.html#wp1105284

I am a bit confused about the logic of your static route though.

ip route 1.1.1.11 255.255.255.255 1.1.1.254

Local LAN subnet is 1.1.1.0/24

So your router assumes that 1.1.1.11 is on the same subnet as its LAN interface - no static route is needed.

[tato386]

mfurnival:

My understanding is that in order to advertise a route it needs to be in the route table.  I want to advertise the smaller /32 subnet which is not in the route table.  Therefore the static route is needed to get it in the table.

Rgds,

Diego

[John Blakley]

The easiest way would be to create a prefix-list and match that on a distribute-list outbound.

I would create a prefix list that matches on everything but what you want, and then deny the routes you don't.

ip prefix-list Allow deny 1.1.1.11/32

ip prefix-list Allow deny 1.1.1.12/32

ip prefix-list Allow permit 0.0.0.0/0 le 32

The interface that you want is s0, so don't apply this list to that interface:

router eigrp 100

distribute-list prefix-list Allow out fa0/0

distribute-list prefix-list Allow out fa0/1

This would deny the route to the neighbors on these interfaces, but it would allow you to advertise it on s0.

HTH,
John

*** Please rate all useful posts ***

[tato386]

John:

What is the purpose of "le 32"?  Isn't 0.0.0.0/0 pretty much a match-all wildcard.

Thanks,

Diego

[John Blakley]

Diego,

The le 32 tells the prefix to go from 0 all the way to 32 bits. If you leave that out, you'd only be allowing the default route in.

HTH,
John

*** Please rate all useful posts ***

[tato386]

John,

What do you think of my static entry for the /32?  My understanding is that if I add it as "ip route 1.1.1.11 255.255.255 g0" the router will consider it a connected subnet and advertise it along with all other conencted subnets.  Is this correct?  I threw out the "ip route 1.1.1.11 255.255.255.255 1.1.1.254" only because maybe I would have better and/or different options if the /32 was considered static vs. connected.

Rgds,

Diego

[John Blakley]

Do you have a diagram of your network? You can create a host route, but where are you going to advertise this from? Are you advertising this route from the router that actually holds this network, or are you going to advertise it from a router that's learned this route from somewhere else?

I had to lab your question up. Regardless of it being a host route pointing to an interface instead of next hop, if you redistribute connected, it doesn't redistribute the static route. You'll need to redistribute the statics if you want those advertised. It does show the route as connected vs static though:

ip route 15.15.15.15 255.255.255.255 FastEthernet0/1

S       15.15.15.15 is directly connected, FastEthernet0/1

HTH,

John

[tato386]

I need to distribute the host route from the router that actually holds this network and I need it to be advertised and propagated by neighbor routers throughout the network.  My setup is that the router has an interface on subnet 1.1.1.0/24 and I need to advertise not only 1.1.1.0/24 but also the smaller host route 1.1.1.11/32 from the same router but the host route I need to advertise out only S0.  The idea is that traffic for this particular IP will come in on S0 while traffic for the rest of the  network will come in on S1 or S2.

Your tests of "ip route 1.1.1.11 255.255.255.255 g0/0" showing up as static is a bummer.  I was hoping it would be treated as connected.  Now this means that I need more lines of code to filter and redistribue static routes as this box has several static routes which I do not want to advertise.  What version IOS did you test on?

Rgds,

Diego

[John Blakley · Accepted solution]

Diego,

I tested on 12.4, but I'm assuming that the result would be the same on the later 15.x IOS. I have 3 routers in a row configured with EIGRP like:

R1 --- R2 --- R3

On R1, I have 1.1.1.1/24 and advertising that to R2 and R3. I'll create a static route on R1:

ip route 1.1.1.13 255.255.255.255 FastEthernet0/1

Advertise that in eigrp:

R1(config)#do sh access-list 1

Standard IP access list 1

    10 permit 1.1.1.13

R1(config-router)#route-map Static permit 1

R1(config-route-map)#match ip address 1

R1(config)#router eigrp 100

R1(config-router)#redistribute static route-map Static

On R3, I'll see the route along with the full /24 subnet:

D       1.1.1.0/24 [90/286720] via 192.168.23.2, 00:05:54, FastEthernet0/0

D EX    1.1.1.13/32 [170/286720] via 192.168.23.2, 00:00:31, FastEthernet0/0

So, it can definitely be done. Since you have other interfaces you need to take into account, I'd recommend referring to my first post to deny this route and then permit everything else. Apply that to the interfaces that you don't want to advertise this route to.

Again, on R3, but this time from R2:

R2(config-router)#do sh ip prefix-list NoHost

ip prefix-list NoHost: 2 entries

   seq 5 deny 1.1.1.13/32

   seq 10 permit 0.0.0.0/0 le 32

R2(config-router)#do sh run | s router eigrp

router eigrp 100

network 192.168.12.0

network 192.168.23.0

distribute-list prefix NoHost out FastEthernet0/1

no auto-summary

I'm blocking the advertisement to R3, but I still have it on R2:

D       1.1.1.0/24 [90/284160] via 192.168.12.1, 00:10:30, FastEthernet0/0

D EX    1.1.1.13/32 [170/284160] via 192.168.12.1, 00:04:33, FastEthernet0/0

     10.0.0.0/24 is subnetted, 1 subnets

On R3:

    1.0.0.0/24 is subnetted, 1 subnets

D       1.1.1.0 [90/286720] via 192.168.23.2, 00:10:21, FastEthernet0/0

     10.0.0.0/24 is subnetted, 1 subnets

The host route is gone, but the parent route still exists.

HTH,
John

*** Please rate all useful posts ***

[tato386]

Thank you very much for your help sir.  Good advice and info.

One more thing if you don't mind.  when using a route-map to redistribute static routes there is an option to "set metric-type internal".  I tried setting these routes to internal but nothing happens and the routes still show up as external and AD of 170.  Does that sound correct to you?

Thanks,

Diego

[John Blakley]

Diego,

The metric-type internal is an OSPF thing and doesn't affect EIGRP. I'm not sure you'll be able to get your redistributed static routes to look like internal routes. You can change the distance for your external routes, but I'm not sure if you want to do this for all since it's an all or nothing approach:

router eigrp 100

distance eigrp 90 90

When talking about AD, AD is used first between routing protocols. When AD matches for two learned routes (you may have learned the same route in eigrp from two different routers), the metric is then used. Keep in mind, even if you change the distance, it doesn't set the route to internal. It will still be seen as an external router because it was redistributed into the eigrp process. It does look like we can use the AD of 90, internal and external, to compare them and then set the metric. I've configured unequal load balancing on this link to show that both get put in the table.

D EX    66.66.66.0 [90/409600] via 192.168.23.2, 00:00:01, FastEthernet0/0

                            [90/156160] via 10.10.13.1, 00:00:01, FastEthernet2/0

If we look in the topology table, we can see that one is internal and the other is external, but AD is the same:

IP-EIGRP (AS 100): Topology entry for 66.66.66.0/24

  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 156160

  Routing Descriptor Blocks:

  10.10.13.1 (FastEthernet2/0), from 10.10.13.1, Send flag is 0x0

      Composite metric is (156160/128256), Route is Internal

      Vector metric:

        Minimum bandwidth is 100000 Kbit

        Total delay is 5100 microseconds

        Reliability is 255/255

        Load is 1/255

        Minimum MTU is 1500

        Hop count is 1

  192.168.23.2 (FastEthernet0/0), from 192.168.23.2, Send flag is 0x0

      Composite metric is (409600/128256), Route is External

      Vector metric:

        Minimum bandwidth is 10000 Kbit

        Total delay is 6000 microseconds

        Reliability is 255/255

        Load is 1/255

        Minimum MTU is 1500

        Hop count is 1

      External data:

        Originating router is 3.3.3.3

Also, if I change the distance back to default, even unequal load balancing doesn't help because the ADs are different:

    66.0.0.0/24 is subnetted, 1 subnets

D       66.66.66.0 [90/156160] via 10.10.13.1, 00:00:01, FastEthernet2/0

But it's still in the table as before. If I shut down f2/0, the other route will get put in the RIB:

     66.0.0.0/24 is subnetted, 1 subnets

D EX    66.66.66.0 [170/409600] via 192.168.23.2, 00:00:05, FastEthernet0/0

So, you can mimic the external route to have the AD as the same as your internal routes, especially if you need to load balance across them. If the ADs are different, you won't be able to do this as far as I'm aware....

HTH,
John

*** Please rate all useful posts ***

[tato386]

Understood sir.  The AD think is not a big deal.  Just my OCD kicking in.  The important part is getting that /32 out there on the right interfaces.  Thank you very much for your help.

Rgds,

Diego

[tato386]

John:

One last thing, for real this time! 

Do you think I can use an _extended_ ACL and "redistribute static route-map HOST-ROUTE" to accomplish all three requirements of:

1)  Advertise static host route

2) Block all other static routes

3) Advertise said static out only one interface

Maybe using the extended ACL I can specify the IP of the interface as source and the host route as destination then maybe I don't have to use all the "distribute-list prefix-list Allow" commands on all the other interfaces?

What do you think?

Rgds,

Diego

[John Blakley]

Hey Diego,

I don't believe you're going to be able to do that. You could create distribution lists to match outbound and tie them to the correct interfaces. Extended acls get kinda confusing for redistribution.

For example, on an incoming update, an extended acl would look like:

access-list 100 permit ip host 172.12.12.12 host 1.1.1.0

This would permit the 1.1.1.0 route from 172.12.12.12, but deny the route from others. I tried to get this update to work outbound, but I simply couldn't get it to work. There are other types of acls that you could use as well:

access-list 100 permit ip 1.1.1.0 0.0.0.255 host 255.255.255.0 which would match on any host in the 1.1.1.0/24 subnet.

Another would be "access-list 100 permit ip host 1.1.1.0 host 255.255.255.0" which practically does the same thing as above.

I would personally use the prefix list because:

ip prefix-list Test permit 192.168.0.0/16 le 24

looks a lot better than

access-list 150 permit ip 192.168.0.0 0.0.255.255 host 255.255.255.0

On an outgoing update, I couldn't get it to filter correctly with the extended acl, but that could be because I was advertising it directly from the router. If you specify the source interface in an extended acl, the only other option that you have is to specify the destination which is the host route (1.1.1.11/32). Now the router has no way of knowing that you want to hand it over to only RouterA but not RouterB. You could do this all inbound though with no issues.

HTH,
John

*** Please rate all useful posts ***