Cisco Switching/Routing :: Create A Route-map For An EIGRP Distribute List On A N7K?
Apr 26, 2012
I'm trying to create a route-map for an EIGRP Distribute list on a N7K, the goal is to not advertise a 10.0.0.0/8 and 172.31.30.20/32 networks out a link to a remote site while permitting all other traffic to the internet (default). I configured the ACL/route-maps below and applied them outbound on the N7K interface but no subnets at all are being received on the remote site router.
ip access-list DENY_10.0.0.0
10 permit ip any 10.244.244.20/30 <<--WAN interface network
20 deny ip any 10.0.0.0/8
25 deny ip any 172.31.30.20/32
30 permit ip any any
Why the below configuration does not work? BGP exchanges routes without a problem all the time the distribute list is removed from the config. When I apply the distribute list it blocks all routes, not just those intended in the prefix list.
We have a 14 offfice MPLS network. All offices have Cisco 3750s running OSPF which replicate route tables via our providers BGP peers. I am introducing a new network in our SF office which is not directly connected so in SF we have a static route "ip route 172.16.20.0 255.255.255.0 192.168.100.1. I want our other offices to learn this route route via OSPF so that they know how to get to the new network. My problem is that of course remote sites do not see our static routes and i have tried to add this via ospf but the switch will not propagate this route because it is not directly connected to the switch in SF.
router ospf 1 log-adjacency-changes network 10.2.0.0 0.0.0.255 area 2.2.2.2
I have a 3750 at a branch running EIGRP connected to two routers that both have configured:
access-list 1 deny 0.0.0.0 access-list 1 permit any access-list 2 permit 0.0.0.0 access-list 2 deny any
router eigrp 1distribute-list 1 out FastEthernet0/0distribute-list 2 in FastEthernet0/0
Due to this recently applied config the switch become unreachable from the outside and cannot ping anything. Everything connected to it works fine. I was able to remote into it from a switch behind it and noticed that the 3750 has no default route in the routing table. I do see a default route in the eigrp topology table. How to make the switch learn a default route maintaining the existing configuration on the routers.
I'm attempting to redistribute a static route into EIGRP on a 3750 switch and pass it to an upstream router, sadly however this isn't working, or at least the route isn't being recieved on the upstream router. [code]
We are deploying a new office in the building next to our main office. The main office has a Cisco ASA 5510 behind that is a Cisco 3750 stack. In the new office we are deploying a new Cisco 3750, they will be connected via fiber cable. I have sliced off VLAN 800 as a transit link /30 with an address space of 10.249.249.1-4. The new 3750 only has two VLAN's 800 and 112 (10.112.0.0/24). VLAN 112 routes are advertised to the neighboring 3750 properly as seen in the routing tables of the 3750 stack:
D 10.112.0.0/24 [90/3072] via 10.249.249.2, 00:22:24, Vlan800
Traffic passes between all local VLANS with no issue. I found in order to get packets to pass between the ASA and the new 3750 I had to add a static route to the ASA:
S 10.112.0.0 255.255.255.0 [1/0] via 10.100.0.1, inside
My question is why is EIGRP not advertising the 10.112.0.0 network to the ASA. Here are EIGRP configs on the switches
I have an issue with my setup of a 6500 switch (12.2(33)SXI9).We have a 6500 switch with several VRF's. For a certain VRF I would like to redistribute a static route in EIGRP. After doing so I don't see the static route on my eigrp neighbor.
This is a overview of my config. I'm basically redistributing only my static route for this vrf in eigrp.
I found a similar case in which the solution was adding a metric to the static route. (eg. redistribute static route-map static-eigrp-pp metric 10000 100 255 1 1500). But the strange thing is that we don't have this issue on a similar machine (same IOS, same config setup). [code]
It looks like the deny statement is not working as I can see all routes I am redistributing. I even did a deny on a specific route and I still see it in the routing table on another router in the autonomous system.The same below works fine on IOS platform. [code]
I config the routers with EIGRP and also write Static route between two PC before remove the link between router0 and router1 , destination is reachable , but when remove this connection , packet from pc1 to pc0 will drop in a loop and never reach to destination , is it possible to have a Link state routing protocol and static route at the same network like this scenario , how to prevent loop in this topology static route is configure as bellow :
We have problem con EIGRP and two ASR 1001 in High Availability. ASR2 have received all route (100 route) from PE, but in ASR1 doesnt received all route (75 route) from PE or from other ASR02. All PE have all route. The ASR1 when modify or lost some route dont update to the ASA. see diagram.
I have an ASA 5520 connected to a Cisco 6509E, and we're turning up EIGRP between the two. The problem that I'm running into is that there a few static routes (including a 0.0.0.0) on the core that's being redistributed into the EIGRP AS, and I need to block this from being propagated to the ASA. The ASA only has the capability to use an ACL in conjunction with a distribute-list, and I can't find a way to filter the default route (0.0.0.0 /0), while allowing everything else.
I have a customer with a primary datacenter and DR datacenter, that has a P2P 100Mbps link connection between them. At the primary Datacenter there will be a Nexus 5596U with a L3 card running EIGRP, it will have three connections, one nothbound to the Internet not a problem, the other is north bound to an MPLS SP managed ISR router. Both datacenters will have MPLS SP managed ISR router, the MPLS service provider will be redistributing BGP into EIGRP from their ISR routers at both datacenters. This means we will learn external EIGRP routes with an AD of 170.
Connected to my 5596 southbound will be the SAN for the EMC storage traffic, the DR also has a SAN with EMC storage as well. The 100Mbps P2P link is primarily for replication traffic.
Since the Nexus 5596U with L3 module doesn't support PBR I have to figure a way for replication traffic to prefer the 100Mbps P2P link vs the MPLS cloud. I was thinking of running iBGP over the P2P link with the Nexus 5596 being a route reflector and it's iBGP peer which will be a Catalyst 3750X at the other end of the P2P link being the route-reflector client. That way both iBGP peers will exchanged learned routes.
I have to come up with a way for the replication traffic that comes sourced from the IP addresses of the EMC/storage to prefer the P2P link which will have an AD of 200 from iBGP in the routing table vs the external EIGRP traffic that has an AD of 170 in the routing table. All other traffic will route normally across the MPLS cloud. All other traffic will include client server traffic as there are application servers that sit south bound of the Nexus 5596, the client traffic will come inbound to the datacenter via the MPLS cloud.
I don't have a Nexus 5596 to do a mock lab. My thought is to redistributed connected with a route-map in EIGRP on the Nexus 5596 with a two match statements then set the IP next hop to the IP of the 3750X. I would need to select only replication traffic, so I was thinking if I can match on vlan and next-hop then my set command would be the next-hop of the 3750X.
I have a mixed WAN environment with both eBGP and EIGRP routes. The BGP routes should always take precedence, when they exist. If no BGP routes exist I want the router to fail over to using the EIGRP routes. So far, this works fine.
The problem is, when the BGP route again becomes available (and the associated entry appears in the "sh ip bgp ... received-routes" output) the router is NOT relinquishing the EIGRP route. It remains in effect, showing as a "D" route int the route table even though there is a better ("B") route available. If I bounce EIGRP or the interface associated with it, the EIGRP route disappears and the BGP route reasserts itself, and everything will run correctly until the next time the BGP route disappears due to maintenance, line failure, etc.
My router is (C2900-UNIVERSALK9-M), Version 15.3(1)T
Here's the associated config interface Tunnel101 description VPN backup WAN interface bandwidth 7168 ip address 192.168.75.1 255.255.255.0 [code].....
In EIGRP, if a router loses the successor to a route, and it has no FS, it goes active (starts asking all neighbors if they have a successor for that route).But if the neighbor did have a successor, shouldn't they have pro-actively told us about it when they learned it (so we already have it as the Feasible Successor?).
Is it possible to track a IPSLA operation and if it goes down track a static route which will be removed from EIGRP process. I have read through documentation and have come stuck. I have the below configured and have shown the features installed. How would I go about getting the below static route injected into EIGRP only if the IPSLA operation in ok?
We have small which I'm looking to implement and have built this on GNS3.
We have:
Router A in site 1 Router B in site 2 Router C in site 3
Router A and B are connection via a point to point 100M link and from Router C we have a 2 point to point one of which is 5Mpbs and going to Router A and Router B.
For Router C to reach Router A network it will go via Router B and these are 100M connection. When the link between Router A and B goes down. Router C should update and start using the 5m route.
For some reson, the routes are not updating. I have to do 'clea ip eigrp ne' for the routes to update and if I reload the routers all works well, it seems the problem is intermittent.
Does 800 series routers support OSPF or EIGRP? Command for EIGRP is available but when you try to run it, you get that "protocol is not available in the image". Is there a specific image that I can get that will support either of these two on a Cisco 851 or 861?
I am having two small issues....First on my 3745 i get the following message:
*Mar 2 12:13:13.615: IP-EIGRP(Default-IP-Routing-Table:1): Neighbor 192.168.3.1 not on common subnet for FastEthernet0/1
*Mar 2 12:13:25.811: IP-EIGRP(Default-IP-Routing-Table:1): Neighbor 192.168.2.1 not on common subnet for FastEthernet0/1
Second problem is that I have my internet connection going to the 3640 on FE0/0 and it works just fine....I want to change over and have the 3745 be the internet router, but when I configure it, I get no connection.
3745 - Current configuration : 1624 bytes ! version 12.4 service timestamps debug datetime msec LD version 0x10 GIO ASIC version 0x127 [Code]...
We recently perchaced 4503 switch with Sub Engine 7L. It has universal IOS. We are unable to run EIGRP and HSRP protocol and the switch came with temporal license.how to proceed further to get EIGRP and HSRP enabled on the 4503 switch.
I am trying to configure EIGRP on my ASA DMZ Interface - topology as follows: [code] The ASA is currently configured for EIGRP with the inside 3560x switch and passing routing updates properly.However, the ASA will not send/receive routing updates to/from the DMZ 3560x switch - the two devices do establish eigrp neighbor relationship. [code]
- Second question is about EIGRP, when I configure EIGRP on the main switch that is AVG with the following commands, will I also have to run the same commands on the second 4948 E too?
Is there a command available on the 6500 that I can use to see what prefixes it is advertising directly to a neighbor?
The diagram is detailed and complex, but the simplest problem statement is that it doesn't look like my 6500 distribution switches are advertising certain prefixes to one of the 6500 access switches. I don't know whether this is an issue of the distribution switches not sending the prefixes down to the access layer (they should be; the route originates on a different set of access switches) or my access switch is dropping the prefixes. I don't see them in the topology table at all.
If the prefix isn't being advertised, I need to troubleshoot the distribution. If it is and it's being ignored, I need to troubleshoot the access. There are no obvious conditions that would prevent the access switch from getting the prefixes -- interfaces aren't passive, no distribute lists at work, everthing in the same AS, I have neighbor relationships (and I am getting other prefixes over these links, and these prefixes are being advertised to other access switches), auto-summarization is off, split horizon is still on . . .
I have a very detailed diagram of all of the metrics and links and I don't see any reason why my access switch shouldn't be getting the prefixes. 6509 chassis, dual sup 720 3B, 12.2(33)SXI4a advanced enterprise services IOS.
We have, for nearly 4 years, used EIGRP on our 6513 to make use of two unequal links to our branch offices. This worked because we could use the variance command and cause EIGRP to insert two routes into the table, one from each carrier. Thus it was we could balance the load to each one with a ratio similar to the ratio of the bandwidth of Link A to Link B.
We just purchased 2 Nexus 7010's to replace our single 6513 core.After much consternation we have found from our Ciscio SE that the Nexus 6.0.2 software rendition of EIGRP does not support variance.
Why would Cisco take their own propriatary protocol and then gut it by removing features? I'm quite ready to send these Nexus boxes back in favor of a newer 6500 series. MEC doesn't work like it is supposed to and the show-tech runs for over 24 hours without ever finishing (and this we can repeat on both boxes, multiple times).
We've opened a tac case but I just wondered for any work around for the 'variance' command?
I have a hub and spoke WAN that conisits of one core location with with a 6500 and nine other buildings using 4006 Catalyst that conenct back to the core via dual gig fiber. We are using EIGRP at each location as well as the core. I was tesing something at one of our buildings decided to hang a 3750 off the 4006 and enable the same eigrp process on the 3750 that is enabled on the 4006 and 6500 (EIGRP 1).
1. All the routes that the 6500 knows about are advertised out to each of the nine locations. 2. The 4006's are all advertising thier directly conencted routes to the 6500.
Onto the location I was testing at:
The 4006 where I was testing at has four vlan interfaces enabled and they are in an UP/UP state. The ip routes from the 4006's directly conencted vlan interfaces propogate to the 6500 at our core location and the 6500 sucsefully propgates these learned routes to all the other 4006's.
This past Friday I configured a 3750x with two /22 vlan interfces and one physical gi port with an IP address and also configured on Ethernet port on the 4006 with an IP address in the same network block as the 3750x gi interface (a /30 netowrk block). I saw both interfaces come up and EIGRP sucesfully established a neighbor adjecency between the 3750x and the 4006.
I noticed that the 3750 advertised out all of it's directly conencted routes to the 4006 and the 4006 advertised it's directly conencted routes to the 3750. However, the 4006 did not advertise any of the routes it had learned from the 3750x to the 6500 and nor did the 4006 advertise any of the routes it had learned from the 6500 to the 4006. My suspicion is that the "eigrp stub connected summary" statement is enabled on both the 4006 and 3750 thus prevenintg them form advertising out any routes other than thier directly conencted routes. Can any of you verify that I'm either correct or inccorect about this?
here are the eigrp statemnets from the 6500 and 4006:
Four 6500 connected to each other to form a full mesh. Switches 4 and 7 is running eigrp. A question came up, why didnt it have eigrp on SW 2 & 3 ? Will it still be redundant if link between SW3 and SW4 is removed? If redundancy is working, SW3 should be able to find its way to SW4 via SW7 or SW2, yes?
Recently, the eigrp was configured to SW 2 and SW 3 as well, it included the “redistribute static” statement. The route for SW2 and SW3 now has the VLANs, 51 or so. Sent ping from a PC to VLAN1 IP of SW3, then link between SW3 and SW4 was disconnected, network connectivity went down for about 20secs, and ping came right back. Thought it was a success. All of a sudden, outside connectivity was lost. Ping within the LAN was successful, but no internet connection.
The eigrp on SW2 and SW3 was removed, and the internet connection came back up. The initial concern was that although there is physical redundancy in place, the other routes may not be known. Hence, eigrp configuration has been attempted for SW2 and SW3. Perhaps the “redistribute static” should have never been configured on SW2 and SW3, SW7 does not have the “redistribute static” statement anyway.
Without eigrp running on SW2 and SW3, does it still have redundancy? For what it’s worth, SW4 and SW7 are both VTP servers. With the current configs, does it still have redundancy? Link redundancy was never tested; it always has been assumed that it works. Later today, with it’s current config, the link redundancy will be tested.
Have cisco router 1921 and 3 cisco switch 3560G i want to configure the cisco router so as network 192.168.4.0/26,192.168.3.0/26,192.168.2.0/26, all to access internet R1921(config)# ip nat inside source list 102 int G0/0 overloadR1921(config)# access-list 102 permit ip ?
I am right to do this below?
R1921(config)# ip route 192.168.4.0/26 10.10.10.2R1921(config)# ip route 192.168.3.0/26 10.10.10.2R1921(config)# ip route 192.168.2.0/26 10.10.10.2
I'm having big problems with the 'ip default-network' command. [URL] I build the topology shown in the above link and it works well. Then I deleted the static route on router 2513 and removed the 'ip default-network' command. I configured RIP on all routers and issued the 'ip default-network 198.10.1.0' command on the upper right router. After that the default route is installed on the 2513 router.But when I configure EIGRP instead of RIP, the default route on 2513 is not installed:
Gateway of last resort is not set
131.108.0.0/16 is variably subnetted, 2 subnets, 2 masks C 131.108.99.0/24 is directly connected, FastEthernet1/1 L 131.108.99.1/32 is directly connected, FastEthernet1/1 161.44.0.0/16 is variably subnetted, 2 subnets, 2 masks
[code]....
Network 198.10.1.0/24 is flagged as default network. I would expect the router to install a default route now but it does not. Experts are recommending to not use the 'ip default-network' command. But it is included in the Route exam so I try to understand it.
We have several DMVPN-connected sites that are connected to our 2821 ISR pair.They're all configured as eigrp stub connected summary. Yesterday, a few of the sites went inaccessible, but the VPN tunnels were still up and running. Upon further investigation, we noticed that the remote sites stopped receiving routing updates from our 2821's. As a quick fix, we added static routes to bring the sites back up.Later that night, we removed the static routes and cleared the eigrp neighbors, hoping it would fix the problem. When it didn't, we cleared them two more times.Suddenly, the router lost all downstream adjacencies. While we were adding statics to at least bring the sites back up, all of the adjacencies came back.
I have a C3825, and have been using standard ACLs and a PBR to route certain HTTP traffic via an alternative default gateway:
route-map RTRMAP-OfficeLAN permit 10 match ip address RTRMAP-OfficeLAN-toADSL set ip next-hop x.x.x.x
This is working absolutely fine, and as expected, all traffic matching the ACL is being sent to x.x.x.x However, we have recently expanded our network, and I am now receiving various networks via BGP from various sources. All BGP incoming via iBGP is tagged in communities:
Community (expanded) access list 100 permit 37xxx:100 Community (expanded) access list 200 permit 37xxx:200 Community (expanded) access list 300 permit 37xxx:300
[code].....
All communities are also matching prefixes when executing either 'sh ip bgp community 37xxx:100' or 'sh ip bgp community-list 100' What I am trying to achieve, is create an EXCEPTION for the policy route. Traffic matching the community lists, must be forwarded based on the routers routing table, whilst traffic maching the ACL, must be sent via the policy route...
route-map RTRMAP-OfficeLAN permit 5 match community 100 200 300 400 500 ! route-map RTRMAP-OfficeLAN permit 10 match ip address RTRMAP-OfficeLAN-toADSL set ip next-hop x.x.x.x
My logic dictates to me that the above should work, but looking at the route-map, I get matches on seq 5 and pacets are exiting the route-map as expected (first matched). However no traffic that does NOT match community 100,200,300,400 or 500 and that DOES match the RTRMAP-OfficeLAN-toADSL never matches.
The counters on the route-map for seq 5 is increasing, but no counters are increasing at seq 10.. It's almost as if seq 5 is matching all traffic.
