Cisco VPN :: ASA 5510 Not Advertising Routes

Feb 15, 2011

I have an ASA 5510 that is configured for a remote access VPN
When users login, they are given an address from a locally defined pool ( /24). Users can log in fine.
I have enabled EIGRP on the ASA and I have configured the following to be advertised:
1. (default)
2. /24 (dmz network)
3. /24 (vpn pool)
I have also enabled reverse-route injection.
The problem I am having is that the VPN pool network is not being advertised via EIGRP, but the other networks are.
The other issue I am having is that even though I have created access-lists that allow the inside network ( to ping the DMZ interface ( on the ASA, the ASA is not allowing it. I have also created an ACL that allows the DMZ interface to ping inside, but this fails as well.

View 1 Replies


Cisco VPN :: ASA 5510 / VPN Client Unable To Add Routes In Windows 7

May 23, 2012

Having an issue with the ipsec client being unable to add routes in Windows 7 while connecting to an asa 5510 running 8.3(2). Client connects, but the split-tunnel routes do not get installed on the OS. Vpn client versions used are and x64. The client status window shows that it received the split tunnel networks, but the log shows that the routes do not get installed with the following message:
     Sev=Warning/2 CVPND/0xE3400013
     AddRoute failed to add a route with metric of 100: code 87


View 9 Replies View Related

Cisco WAN :: EIGRP 101 - Prefer External Routes Versus Internal Routes?

Apr 8, 2011

Is there a way in EIGRP to prefer external routes versus internal routes. EIGRP always picks up internal routes as long as they are available, no matter if external routes have better metric. Our Scenario is that we have DMVPN hub and spoke topology running EIGRP 101. The Core routers also on EIGRP 101 prefer EIGRP 101 routes. We have the new MPLS network running BGP and redistributing these BGP routes into EIGRP 101. The core routers prefer EIGRP 101 routes (internal) to redistributed BGP (external) routes.

View 9 Replies View Related

Cisco :: Advertising In BGP - IP Route Doesn't Appear?

Mar 4, 2013

I am advertising the network from R5 to R1 via EBGP. The problem is that on the Router R1 I see the route whith show ip bgp command but in the show ip route don't appear.I thinked that the problem was SYNCHRONIZATION,so that will activated synchronization on the routers R1 and R4 but don't work. Furthermore the routers R2 and R3 neither receive the route via OSPF.

View 11 Replies View Related

Cisco WAN :: Advertising BGP Route Learned Back To Same AS 7018

May 18, 2011

I have a situation where my Internet edge routers learn 0.0 from ATT (AS 7018) my provider.  I then wish to advertise these learned routes via WAN.  However my WAN MPLS provider is also ATT and they use AS 7018 for that as well.  When I try to push 0.0 to my other WAN sites 0.0 is suppressed to avoid loops.What's the best way to tell the WAN routers to advertise 0.0 back to the same AS originally learned from?

View 16 Replies View Related

Cisco WAN :: 7200VXR - BGP Advertising Default Route In Mutihomed Network

Feb 25, 2011

I have Cisco 7200vxr doing BGP with 2 directly connected ISP's over ethernet. I am receiving default routes only, and have added a higher weight to my routes learned from my primary ISP. below is my configuration (ip addresses changed of course)
router bgp 100 no synchronization bgp router-id x.x.x.x bgp log-neighbor-changes network mask network network mask
neighbor <ISP_A-IP> remote-as 200  neighbor <ISP_A-IP> weight 175 neighbor <ISP_B-IP> remote-as 300  neighbor <ISP_B-IP> weight 150 auto-summary
Advertising my rotues to the primary ISP is fine
7206vxr.rb#sh ip bgp neighbors <ISP_A-IP> advertised-routesBGP table version is 7, local router ID is x.x.x.xStatus codes: s suppressed, d damped, h history, * valid, > best, i - internal,              r RIB-failure, S StaleOrigin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path*>                  0         32768 i*>             0         32768 i*>                  0         32768 i
 Total number of prefixes 3
However, advertisements to the secondary ISP inlcludes the defautl route learned from the primary 7206vxr.rb#sh ip bgp neighbors <ISP_B-IP> advertised-routes BGP table version is 7, local router ID is x.x.x.x Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
*>          <ISP_A-IP> *>                  0         32768 i*>             0         32768 i*>                  0         32768 i
Should I not just only be advertising just the networks that i specified in my configuration?

View 3 Replies View Related

Cisco Switching/Routing :: 6500 What Prefixes EIGRP Advertising

Dec 29, 2011

Is there a command available on the 6500 that I can use to see what prefixes it is advertising directly to a neighbor?
The diagram is detailed and complex, but the simplest problem statement is that it doesn't look like my 6500 distribution switches are advertising certain prefixes to one of the 6500 access switches.  I don't know whether this is an issue of the distribution switches not sending the prefixes down to the access layer (they should be; the route originates on a different set of access switches) or my access switch is dropping the prefixes.  I don't see them in the topology table at all.
If the prefix isn't being advertised, I need to troubleshoot the distribution.  If it is and it's being ignored, I need to troubleshoot the access.  There are no obvious conditions that would prevent the access switch from getting the prefixes -- interfaces aren't passive, no distribute lists at work, everthing in the same AS, I have neighbor relationships (and I am getting other prefixes over these links, and these prefixes are being advertised to other access switches), auto-summarization is off, split horizon is still on . . .
I have a very detailed diagram of all of the metrics and links and I don't see any reason why my access switch shouldn't be getting the prefixes. 6509 chassis, dual sup 720 3B, 12.2(33)SXI4a advanced enterprise services IOS.

View 14 Replies View Related

Cisco Firewall :: ASA 5585 -Advertising Public Subnets Used By NAT Using OSPF

May 27, 2013

ASA 5585-x10, ver 9.1. I have about 10 public sub nets that will be used for NAT translation on the outside interface.  These sub nets are different from the sub net the outside interface. Is there a way to advertise these routes using OSPF from the ASA? 
I tried to redistribute a static route, but can't make the destination router an interface that is on the ASA. I  don't own or control the upstream router.

View 1 Replies View Related

Cisco :: BGP Routes Not In Routing Table?

Feb 4, 2013

We have a BGP / OSPF configuration as shown in the topology picture. When the connection towards Internet is taken down, we expect the traffic to be forwarded toward WAN 2 (preferred) or WAN 1. The problem is that the BGP learned routes disappears when the Internet connection is taken down. The IP routing table on R2 only shows internal networks and the networks between R2 and WAN 1 and 2. No routes to internet is shown. We run "show ip bgp neighbors <ip-to-wan-1-router> received-routes" it contain internet routes. And when we run "show ip bgp neighbors <ip-to-wan-1-router> routes" it contains no routes at all.

View 2 Replies View Related

Cisco WAN :: How Many Routes Support 7206VXR With NPE-G2

Jul 24, 2011

How many routes support 7206VXR with NPE-G2?

View 2 Replies View Related

Cisco WAN :: How Many IP Routes Does 3825 Support

Jan 23, 2011

I want to know the number of routes supported by CISCO3825-HSEC/K9(512MB DRAM).

View 2 Replies View Related

Cisco VPN :: ASA 8.4(3) Dynamic VPN And Static Routes?

May 20, 2012

I am running an ASA with 8.4(3) and am trying to setup a dynamic VPN tunnel.  We are having a business reason to establish a VPN tunnel to customers who do not have nailed down IP addresses.  Now I found a number of documents that outline the steps involved.  It seems the basic steps were to Establish a regular tunnelAdd dynamic crypto mapAssign the dynamic crypto map to the tunnel created under step 1. While this sounds pretty straight forward and simple, while prepping for doing just this I hot a road block while thinking it through. In order for my ASA to put anything into the tunnel it has to have a route to the remote network pointing at my VPN peer at the  end of the tunnel.  How do I do this in a dynamic tunnel?  How do I add a dynamic route so the ASA knows which tunnel to stuff the traffic into?  How do I stop the traffic from just being send to the Internet?

View 1 Replies View Related

Cisco WAN :: Setting Up Routes On ASA 5505?

Dec 12, 2012

I'm trying to set up a Cisco ASA 5505. I'm mainly setting things up through ASDM but I also have console access. Right now while I'm setting it up I have the outside/Vlan2 port attached to my existing network and a laptop connected to the inside/Vlan1 port. More info about that:
interface Vlan1
nameif inside
security-level 100


Before I added that last "" entry, the ASA would not see anything on the internet. Now I can ping any external IP address from the router's console. However, the laptop I have connected to the 'inside' port still cannot reach any IP address outside the network. Every time I try to add a similar route for the 'inside' interface, I get the following error: "You have another route configured for this network any which has same gateway and same metric 1. You cannot add a duplicate route." I know I'm misunderstanding something here. In order to make devices connected to the 'inside' port connect to the internet, I need to set up a new route that will direct these devices to, right?

View 9 Replies View Related

Cisco WAN :: ASR 1000 With 4M Routes Support

Jul 5, 2011

For ASR1000 to support 4M routes, RP2 must be used. 
1) RP2 need to have 16GB memory in order to support 4M routes?
2) Need to use ESP20/40 together with RP2?
3) If RP2 + ESP10, supporting route table size down to 1M?
4) 4M routes is shared for both IPv4 an IPv6?
5) SIP card will affect route table size?

View 1 Replies View Related

Cisco WAN :: C4507R+E - Maximum Routes Sup 7E?

Mar 10, 2013

I'm using a Catalyst 4500 switch (C4507R+E) with Sup 7E. Cisco Datasheet of this switch says that it can learn maximum 256K IPV4 routes. Currently it just learns 10330 ipv4 routes. However when I show platform hardware ip route summary, it seems that the FIB is just free 100K routes as below output:

Entity        total         used      free      util%                             
Entries       260096    10332      249764    3                                
  UC Ipv4     110592     10331     100261    9                                                                
  unused      147456    147456    0            100      
My question is: Can I make use of all 147456 unused routes? Or these ones have to use for any special purpose?

View 1 Replies View Related

Cisco :: ASA VPN Clients Creating Static Routes?

Nov 15, 2011

In my live VPN concentrator at work, my 5520 is showing a static route for each VPN client that is connected to my SSL vpn right now. This kind of confused me because wouldn't only one route to the address pools subnet be needed for my vpn users?

View 12 Replies View Related

Cisco :: How To Remove These L Routes In Routing Table

Apr 2, 2013


How can you remove these "L" routes in routing table?

View 6 Replies View Related

Cisco Switches :: SG300-10 IPv4 Routes Bug?

May 10, 2013

I bought the SG300-10 Switch a few days ago and updated it to firmware, but i think there's a bug in this firmware. If I go to "IP Configuration" IPv4 Routes" in L3 Mode nothing is displayed. In the log file i see that:
21474773112013-Mar-16 09:51:34Error%HTTP_HTTPS-E-DIAGNOSTICS: ERROR - in <RL_vtLeadTableGet> tag, can not find the table rlInetRoutingDistanceTable in the MIB.       21474775182013-Mar-14 22:39:22Error%HTTP_HTTPS-E-DIAGNOSTICS: ERROR - in <RL_vtLeadTableGet> tag, can not find the table rlInetRoutingDistanceTable in the MIB., aggregated (1)               
Reset of the Switch doesn't work.

View 4 Replies View Related

Cisco WAN :: 7301 Hundreds Of Static Routes For IP

Jan 27, 2012

We have a Cisco 7301 concentrator, well two of them in HSRP configuration.  We have multiple VPN's setup on that router (crypto map based).  Recently we noticed the following:
- There is one IP address that has hundreds of static routes for some reason

- VPN for this customer is working, but I'm trying to find out why this is happening. 
Here is how it looks like: S 0xF5FFFF2C [1/0] via "ip-address".There are hundreds of entries for a single IP there.

View 2 Replies View Related

Cisco WAN :: R3 Is Not Rebroadcasting BGP Routes Into RIPv2 As Needed

Jul 24, 2011

I am working on a network that has four nodes/Currently I have RIP running in between R1 and R2, and between R3 and R2. These are shared and R1 can access R3 just fine.R3 is running BGP and communicating with R4.R3 can ping everything in R4's network with no difficulty.Currently R3 is not rebroadcasting the BGP routes into RIPv2 as needed.I have tried clearing my BGP session and am still not able to get the BGP routes from R4 to R1.

View 1 Replies View Related

Cisco WAN :: How To Separate BGP Routes Within AS65100 To Other AS65101

Mar 6, 2012

   |                                                          |
    |                         AS65101                          |
Routers A1,A2,B1,B2 are in AS 65100
Routers 1 and 2 are in AS 65101 
Routes from the network2 to network3 should go through RouterA1-Router1
Routes from the network1 to network3 should go through RouterB2-Router2
As for now all routes within AS 65100 to AS 65101 goes through RouterB2/Router2

View 3 Replies View Related

Cisco WAN :: 2911 With Partial EBGP Routes

Jun 29, 2011

a customer of us asked if C2911 (to be bought) is ok for partial BGP routes.This is the situation: 2 cisco 2911, each peering with 3 other AS (AS1, AS2, AS3), and maybe, in the future, at a small IXP (AS4, AS5, AS6, AS7).They will accept defaults plus partial routes from upstream AS1, AS2, AS3.When deployed at the IXP they also will accept partial routes from AS4-7.So, is 2911 ok for that configuration?the default route is included in the first row of as-path, isn't it?I have no experience with partial routes, only with full (for our datacenter) and default only (for other customers).

View 5 Replies View Related

Cisco WAN :: Filtering Routes In Ospfv3 Ipv6?

Apr 7, 2013

i been filterin LSA type 3 and the table route localy routes en ospf v2 ipv4 whit the commands distribute-list , area filter-list route-maps ACL and prefix-lis ¿but how can i do the same filterin in ipv6 whith OSPFv3?

View 2 Replies View Related

Cisco WAN :: WS-C3560G-48TS-E How Many BGP Routes It Can Support

Feb 7, 2012

We are planning to run BGP on our pair of 3560G switch, I would like to know how many bgp routes it can support? it currently running on advance IP service.

View 4 Replies View Related

Cisco WAN :: Use IP SLA To Monitor Remote Routes On CAT6500?

May 6, 2012

I need to use IP SLA to monitor remote routes on CAT6500

CAT6500 is running "sup-bootflash:s72033-jk9o3sv-mz.122-18.SXD7b.bin" on SUP720
Feature Navigator said it is
ENT FW W/MPLS/IPV6/SSH/3DES After drill down into feature set I found that this version support for IP SLA such IP SLAs - ICMP Path Echo Operation

BUT, back to console I can not do such (config) ip sla command (not found cmd CAT6500(config)# ip sla 1) What I did wrong or others cmd imply this ip sla process?

View 1 Replies View Related

Cisco WAN :: C880 ISR Interfaces And Routes Not Active

May 4, 2011

There is a strange problem with :c880data-universalk9-mz.150-1.M4.bin IOS. I can't ping gateway IP address and "sh ip route" does not show any routes.
interface FastEthernet4
ip address a.b.82.66
duplex auto
speed auto

View 7 Replies View Related

Cisco VPN :: C3660 Passing IP Routes To VPN Clients

May 19, 2013

We've got a fairly plain-vanilla VPN configuration on a C3660 router running IOS 12.3(26) so that our employees can initiate VPN sessions to our office using their Windows or Linux workstations.  In a typical windows L2TP VPN configuration, the default route is set to the VPN server, and no other routes are passed to the clients, which means that if the client disables "use default route" setting, even getting to the office network fails. 
I know there's a way to do this, but I haven't found it yet.  What I want to do is pass local routes to the client so that only those routes transit the VPN, and permit the clients to use their own default routes.

View 1 Replies View Related

Cisco WAN :: AS1234 View Internal IP Routes

Jan 31, 2013

Is there anyway I can see how many routes are internal to an AS?
So, something like "show ip route in AS1234" where AS1234 is the local AS number. All internal routes within AS1234 are being parsed around via iBGP, but AS1234 has a full BGP table from upstream provides so "show ip route" shows all local and global routes. How can I see all the routes within the local AS only?

View 2 Replies View Related

Cisco WAN :: 3750 Cannot See Routes Being Exchanged Between Cat3750_2 And ASA

Sep 11, 2011

I have a question regarding EIGRP.I have an ASA and two 3750 switches connected as follows  ASA---eth----Cat3750_1----eth----Cat3750_2.All of them are configured for eigrp 100. Routes are being exchanged between ASA and Cat3750_1 and between Cat3750_1 and Cat3750_2. But for some reason I cannot see the routes being exchanged between Cat3750_2 and ASA. [code]

View 3 Replies View Related

Cisco VPN :: 1941 Disappearing IPsec Routes With RRI

Aug 26, 2012

I am trying to set up a pair of 1941 routers in a HA configuration to act as L2L VPN gateways. The active router of the pair should distribute routes to the remote destinations using OSPF to internal routers. The VPN part is working fine and the routers are correctly advertising routes to internal hosts, however my problem is that when an IPsec sessions disconnect, the routes disappear and therefore internal hosts cannot reestablish a connection. If the remote end establishes a connection, the routes appear again and connectivity is restored.
My setup is as follows: (ASA) --> (pvpn01 & pvpn02 HA pair) --> (internet) --> (remote peer)
The other router in the pair has exactly the same config except with different interface IPs. The remote end is configured to talk to the HA address VPN routers are both running IOS version 15.0(1r)M9.
When I initially boot the routers, the route for appears in 'show crypto route', and is advertised to neighboring routers. If I ping an address on that network an SA is established and stays active as long as there is traffic flowing. pvpn02#show crypto  route
If I then stop traffic flowing over the tunnel and wait until the IPsec SA lifetime is expired, the route is deleted from the system routing table and therefore not distributed by OSPF. The result is that internal hosts cannot reestablish the tunnel as the other routers have no route to the network.
Is this a bug, or is there another way to get the RRI routes to persist on the active router?

View 2 Replies View Related

Cisco Routers :: RV042 Not Announcing VPN Routes Over RIP V2

Nov 7, 2012

Problem: RV042 is not announcing a class C VPN route via RIP to other routers. It announces the gateway public address via rip, but not the VPN route.
I am attempting to use a pair of RV042 as a redundant links between our home office and a branch. The home office and branch is already connected via a T1. Each location also has an additional cable internet connection with public IP address and a cisco 1921 router controlling the traffic.
The 1921 routers are using OSPF to route traffic over the T1 and have RIPv2 enabled to talk to their local respective RV042s. Here is a description of how the network is set up.
MainRouter - cisco 1921
Eth0 - Network is
IP address is
Eth0/1 - Network
T1 connection to branch router

Anyhow I'm thinking a workaround might be to set up a GRE tunnel across those 10.0.X.X subnets to the other side so I can at least dynamically route traffic accross.... Without the RIP routes being announced I don't have automatic failover!

View 6 Replies View Related

D-Link DIR-615 :: IPv6 Static Routes

May 5, 2011

Will there be a way sometime in the future to add static IPv6 routes?  I have a routed /64 and a routed /48 from a tunnel broker that terminates on my DIR-815, and I want to hang the /48 off of another router that I have attached to my LAN interface(goes to my home lab setup that I use for my job).  I could just move the tunnel endpoint to the other router, but I like having IPv6 access for all my other PCs on the LAN segment.

View 1 Replies View Related

Cisco :: 2800 How To Configure And Setup Routes Properly

Jul 8, 2011

I have a 2811 router that I want to configure the F/E 0/0 & 0/1 to be able to communicate.FE 0/0 is configured with 0/1 is configured with Physically attached to this port is going to be a wireless router configured with question is how to configure and setup the routes properly and do I need to configure NAT and Access Lists.

View 9 Replies View Related

Copyrights 2005-15, All rights reserved