ASA 5585-X Route-Map

Hi,
how can apply  route-map rules to an interface ?
i set up some rules but i cannot apply these rules any interface.
Thanks a lot.

Thank you Kanwal.
in a cisco router you can apply your route-map by using command ip policy map ... İ didnt find any command like this. İ set up some match and set conditions but i do not apply any interface.
can i use route-map to manipulate routing table İn asa 5585-x.?
sincerely

Similar Messages

  • Which routing protocols are supported on ASA 5585

    Hi,
    I am curious to know which routing protocol is well supported on Cisco ASA 5585. do someone on the forum has implemented routing on ASA?
    I have ASA 5585 on context mode, as of now 4 contexts have been created. upstream device is Nexus.
    I have ASA with Software Version 8.4(4)1 and Device Manager Version 6.4(9).
    if someone can point me to good implemented example of routing protocol to their environment (like OSPF, BGP) that would be great.
    Thanks

    You're welcome.
    Multiple contexts adds another twist - in ASA 8.4 dynamic routing protocols are not supported at all for multiple contexts. Reference.
    ASA 9.0 added support for dynamic routing protocols in multiple context modes, including OSPF v2 (but not v3 for IPv6). Reference.
    FYI ASA 9.1(2) is current as of this writing and is the recommended release in the 9.x train. (Mentioned near the end of the latest TAC Security podcast - episode #37 here.)

  • Vlan on asa-5585

    Hi,
    Is there any way to create vlans on cisco asa 5585 similar way we do for cisco switches.
    The asa in this case is an interface for subsidary users to connect into this new network.
    We require few vlans to be created for some servers on the firewall. the firewall should be the gateway for these servers.
    eg. vlan 100 - 192.168.100.1/24 should be on the ASA firewall.
    How do we achieve this?
    Appreciate all help on this.

    Hi,
    You will have to configure atleast one physical interface as a Trunk interface if you want to bring the Vlan all the way to the ASA. Essentially the configuration follows the same lines as configuring a Cisco router to act as the gateway for multiple Vlans behind a switch.
    The actual configuration format depends on how you have set up the ASA. Is it Single Context or Multiple Context?
    In Single Context the configuration would be something like this
    interface GigabitEthernet0/0
    description TRUNK
    interface GigabitEthernet0/0.100
    vlan 100
    nameif LAN
    security-level 100
    ip add 10.10.10.1 255.255.255.0
    interface GigabitEthernet0/0.200
    vlan 200
    nameif DMZ
    security-level 50
    ip add 192.168.10.1 255.255.255.0
    If you are running Multiple Context mode the configuration could be something like this
    interface GigabitEthernet0/0
    description TRUNK
    interface GigabitEthernet0/0.100
    description LAN
    vlan 100
    interface GigabitEthernet0/0.200
    description DMZ
    vlan 200
    context EXAMPLE-CONTEXT
    allocate-interface GigabitEthernet0/0.100
    allocate-interface GigabitEthernet0/0.200
    config-url disk0:/EXAMPLE-CONTEXT.cfg
    Or something along these lines
    Hope this helps
    Please do remember to mark a reply as the correct answer if it answered your question.
    Feel free to ask more if needed.
    - Jouni

  • Route-map after tunnel end point

    Hello Folks. I have an ASA5510 with multiple tunnels terminating into it. Some sites require a hairpin bend out into the internet after terminating, this works fine with an applicable NAT statement, however, is it possible to use a route-map to route this traffic that would normally hair pin bend out the same interface back into the internet, but rather go out through another link on another host?

    yes, you can
    but not with route map because in ASA there is not route map
    so u need first put the folowing command to allow the tunnel exit from the same interface where it is terminated orginally
    issue the
    same-security-traffic intra-interface
    command in the global configuration mode
    and for more configurations details use the following link will be useful for your case
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807f9a89.shtml
    good luck
    Please, Rate if helpful

  • Route-Map Query

    Hi All,
    I'm trying to achieve the following -
    I have a host 10.44.125.70.
    If going to any Internal address space I want the host to use a certain next hop (vlan interface on core this PBR is configured). Then IF going to anywhere else (e.g external address) , use a different next hop. I have the below but doesn't seem to be working as expected. Is my first route-map entry catching all traffic? I'm sure what I'm trying to do is very simple...
    IP access list Sent_Inside
        10 permit ip host 10.44.125.70 172.12.0.0 0.0.15.255
        30 permit ip host 10.44.125.70 10.0.0.0 0.255.255.255
     IP access list Sent_Outside
        10 permit ip host 10.44.125.70 any
        20 permit ip host 10.44.125.70 any
    route-map TEST permit 20
     match ip address Sent_Inside
     set ip next-hop 10.44.125.1
    route-map TEST permit 30
     match ip address Sent_Outside
     set ip next-hop 10.44.141.7

    Exactly John, a different default route already exists. Because I have a static NAT on the ASA (10.44.141.7) for this host of mine, I need to make sure all Internet traffic uses the ASA and not the default route on the Core.
    What is happening at the moment is - If I have just the below.Then the device 10.44.125.70 is accessible from the Outside on my Nat'd external address (ASA config is all good and setup with NAT etc..). I then realised I could not access my hosts internal IP within the network so i added the extra parts to my route-map. Upon doing this my NAT stopped working (but I could then access my internal address internally). Not going to be able to test this again until tomorrow either which isn't ideal.
     IP access list Sent_Outside
        10 permit ip host 10.44.125.70 any
        20 permit ip host 10.44.125.70 any
    route-map TEST permit 30
     match ip address Sent_Outside
     set ip next-hop 10.44.141.7

  • IPSec ikev2 between ASA and Cisco Router

    Hi,
    i try to do IPSec with ikev2 (SHA2) between ASA and Cisco Router, without success. Any one can help me ?
    - Remote site (Router) with dynamic public IP -> Dynamic crypto map on the ASA
    - Authentication with Certificats
    - integrity sha2
    I try a lot of configurations without success.
    Thanks for your help.
    Mic

    The more secure ike policy should have the higher priority which is a smaller number. So I would configure there the following way (policy 30 only if really needed):
    crypto ikev1 policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 28800
    crypto ikev1 policy 20
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 28800
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 43200
    The Cisco VPN Client is EOL and not supported any longer. And yes, by default DH group 2 is used. But that can be configured by a parameter in the PCF-file.
    There are two (three) better options:
    Best option with very little needed configuration:
    Move to AnyConnect with TLS. AnyConnect is the actual Cisco client that is also supported with Windows 8.x. The legacy IPsec client isn't.
    Best option with a little stronger crypto but more configuration:
    Move to AnyConnect with IPsec/IKEv2. 
    Move to a third-party client like shrew.net. I didn't use that client since a couple of years any more, but it's quite flexible and also has a config for a better DH-group.
    For option 1) and 2) there is an extra license needed, but thats not very expensive.

  • ASA 5585 port-channels

    I want to create a port-channel with 2 10Gbs interfaces on 2 ASA 5585 firewalls, and set them up in a failover pair.
    In order to do this, do I simply put two 10Gbs interfaces into a channel and then configure the IP addressing and failover address on the logical port-channel interface? (aka interface po1).
    Any limitations with this?

    Yes, that is exactly what you do..
    Create portchannel on switch and ASA
    Trunk the vlan on switch side
    Create logical interfaces on ASA

  • Managing Route-Map based MPLS VPN

    1) How to derive the VPN information of the MPLS VPN configured using route-maps? As I understand, stitching route-maps information to derive VPN is complex as it is difficult to derive & correlate the filters tied to each of the route-maps that are tied to a VRF :(
    2) Is there any MIB to get from the MIB
    a) Route-maps tied to each VRF
    b) What is the filter associated with each route-map?
    c) Definition of each of the above filter
    It would have been nice if the route-maps' name had global-significance within AS, so that we could have treated route-maps, pretty much like the route-tragets. Alas, I doubt it is :(
    It should be noted here that if the MPLS VPN is configured using route targets, the VPN information derivation is fairly straight forward throught MplsVpn MIB.
    So, the question is what is the simplest way to derive the MPLS VPN info given that they are configured using route-maps in BGP for labelled-route-distribution & for the pkt association with the VRFs.
    Thanks,
    Suresh R

    Each CE in a customer VPN is also added to the management VPN by selecting the Join the management VPN option in the service request user interface.
    The function of the management route map is to allow only the routes to the specific CE into the management VPN. The Cisco IOS supports only one export route map and one import route map per VRF.
    http://www.cisco.com/en/US/products/sw/netmgtsw/ps4748/products_user_guide_chapter09186a0080353ac3.html

  • BGP Outbound Route-Map Question

    Hi Experts,
    Just need your help again. I was trying to do some lab and I came across this weird behaviour with BGP outbound route-map. The diagram is simple.
    Please see attached diagram. Sorry for the very poor illustration. R6 has iBGP peering to both R4 and R1. Both R1 and R4 have eBGP peering to R5. No IGP running on any routers as well to keep things simple. There are 2 things to do.
    * Create a static route for 160.1.0.0/16 pointing to Null0 on both R1 and R4 and advertise to BGP via network statement but only R5 should be able to see the 160.1.0.0/16 route. R6 should not receive it.
    * Advertise R5's /32 loopback interface to BGP but ensure R6 to have that route in its routing table. Don't use next-hop-self on both R1 and R4. Don't advertise WAN link via network command.
    I'll just illustrate R4 and R6 here to keep things straight forward.
    R4#sh ip bgp
    BGP table version is 5, local router ID is 150.1.4.4
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    *> 150.1.5.5/32     155.1.45.5               0             0 100 i
    *> 160.1.0.0        0.0.0.0                  0         32768 i
    R6#sh ip bgp
    BGP table version is 11, local router ID is 150.1.6.6
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    * i150.1.5.5/32     155.1.45.5               0    100      0 100 i
    * i                 155.1.0.5                0    100      0 100 i
    The first task was achieved as the 160.0.0.0/16 route is not present in R6's table. I used these commands in R4.
    router bgp 65000
     no synchronization
     bgp log-neighbor-changes
     network 160.1.0.0
     neighbor 155.1.45.5 remote-as 100
     neighbor 155.1.146.6 remote-as 65000
     neighbor 155.1.146.6 route-map R6_OUT out
     no auto-summary
    route-map R6_OUT deny 5
     match ip address prefix-list AGGR
    route-map R6_OUT permit 1000
    ip prefix-list AGGR seq 5 permit 160.1.0.0/16
    So with the configuration above, it is clear that R4 is hitting route-map line 5 to deny 160.1.0.0/16 being advertised to R6. I tried to remove line 5 to validate as well if the /16 route will be advertised to R6 and it did so route-map configuration above is confirmed working.
    Next, advertise loopback 0 of R5 to R6 and make sure it is a valid route in BGP table without the use of next-hop-self or WAN advertisement.
    I used the following configuration.
    ip prefix-list R5_LINK seq 5 permit 155.1.45.5/32
    route-map R6_OUT permit 10
     match ip route-source R5_LINK
     set ip next-hop 155.1.146.4
    I inserted line 10 in between route-map 5 and 1000. So R4 would check its route table for routes with 155.1.45.5 as route-source then advertise it to R6 with next-hop address of 155.1.146.4. It worked!
    R6#sh ip bgp
    BGP table version is 15, local router ID is 150.1.6.6
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    *>i150.1.5.5/32     155.1.146.4              0    100      0 100 i
    * i                 155.1.0.5                0    100      0 100 i
    *>i160.1.0.0        155.1.146.4              0    100      0 i
    As you can see above, 150.1.5.5 route is now a valid BGP route but surprisingly, the 160.1.0.0/16 route is there! From what I have seen, BGP skipped line 5 and started at 10. Even if I insert the same rule as line 5 and make it as line 15, it's not working. The /16 route is still being advertised. If I remove the match ip route-source clause in sequence 10 then it will withdraw the 160.1.0.0/16 route again. Looks like "match ip route-source" is not very friendly with direct filtering to BGP neighbors but I saw this being used with BGP inject-map and it worked well.
    R4#sh route-map
    route-map R6_OUT, deny, sequence 5
      Match clauses:
        ip address prefix-lists: AGGR
      Set clauses:
      Policy routing matches: 0 packets, 0 bytes
    route-map R6_OUT, permit, sequence 10
      Match clauses:
        ip route-source (access-lists): R5_LINK
      Set clauses:
        ip next-hop 155.1.146.4
      Policy routing matches: 0 packets, 0 bytes
    route-map R6_OUT, permit, sequence 1000
      Match clauses:
      Set clauses:
      Policy routing matches: 0 packets, 0 bytes
    Any thoughts why this is happening?
    Thanks in advance.

    Hi John,
    I did a small lab to test feature "match ip route-source" and it is working fine. Please check below config and output.
    R4 does not have 172.16.16.0/24 and also routes for which next-hop is not 1.1.1.1. In case you still facing issue, please share output of "debug ip bgp updates out"
    Topology
    R1--ebgp--R3---ibgp---R4
    R3#show ip b su | b Nei
    Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
    1.1.1.1         4          100      34      36       29    0    0 00:27:37        7
    4.4.4.4         4          300       9      12       29    0    0 00:04:12        0
    R3#
    R3#sh route-map TO-R4
    route-map TO-R4, deny, sequence 10
      Match clauses:
        ip address prefix-lists: DENY-PREFIX 
      Set clauses:
      Policy routing matches: 0 packets, 0 bytes
    route-map TO-R4, permit, sequence 20
      Match clauses:
        ip route-source (access-lists): 20 
      Set clauses:
      Policy routing matches: 0 packets, 0 bytes
    R3#
    R3#show ip prefix-list DENY-PREFIX
    ip prefix-list DENY-PREFIX: 1 entries
       seq 5 permit 172.16.16.0/24
    R3#
    R3#sh ip access-lists 20
    Standard IP access list 20
        20 permit 1.1.1.1 (25 matches)
    R3#
    R3#show ip b
    BGP table version is 29, local router ID is 3.3.3.3
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale, m multipath, b backup-path, x best-external
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    *  172.16.8.0/22    1.1.1.1                  0             0 100 i
    *>                  172.31.13.1             20         32768 i
    *> 172.16.16.0/24   1.1.1.1                  0             0 100 i
    *> 172.16.17.0/24   1.1.1.1                  0             0 100 i
    *> 172.16.19.0/24   1.1.1.1                  0             0 100 i
    *> 172.16.20.0/22   1.1.1.1                  0             0 100 i
    *  172.16.24.0/30   1.1.1.1                  0             0 100 i
    *>                  172.31.13.1             20         32768 i
    *> 172.16.80.0/22   1.1.1.1                  0             0 100 i
    R3#
    R4#show ip b
    BGP table version is 53, local router ID is 4.4.4.4
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale, m multipath, b backup-path, x best-external
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    r>i172.16.17.0/24   1.1.1.1                  0    100      0 100 i
    r>i172.16.19.0/24   1.1.1.1                  0    100      0 100 i
    r>i172.16.20.0/22   1.1.1.1                  0    100      0 100 i
    *>i172.16.80.0/22   1.1.1.1                  0    100      0 100 i
    R4#
    --Pls dont forget to rate helpful posts--
    Regards,
    Akash

  • Route map no match

    Hi,
    what is the reason for not having any match, in the acl for the route-map?
    Current configuration : 1731 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname R2
    boot-start-marker
    boot-end-marker
    no aaa new-model
    memory-size iomem 5
    ip cef
    interface Loopback0
     ip address 192.168.0.1 255.255.255.0
    interface Loopback1
     ip address 192.168.1.1 255.255.255.0
    interface Loopback200
     ip address 196.0.0.1 255.255.255.0
    interface FastEthernet0/0
     ip address 195.0.0.1 255.255.255.0
     ip policy route-map r_teste
     duplex auto
     speed auto
    interface FastEthernet0/1
     no ip address
     shutdown
     duplex auto
     speed auto
    interface Serial1/0
     ip address 10.0.0.2 255.255.255.252
     serial restart-delay 0
    interface Serial1/1
     ip address 172.16.0.2 255.255.255.252
     serial restart-delay 0
     clock rate 128000
    interface Serial1/2
     no ip address
     shutdown
     serial restart-delay 0
    interface Serial1/3
     no ip address
     shutdown
     serial restart-delay 0
    router bgp 100
     no synchronization
     bgp log-neighbor-changes
     network 192.168.0.0
     network 192.168.1.0
     neighbor 10.0.0.1 remote-as 200
     neighbor 172.16.0.1 remote-as 300
     no auto-summary
    ip http server
    no ip http secure-server
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 172.16.0.1
    access-list 40 permit any
    route-map anuncia1 permit 20
     match ip address 20
    route-map anuncia0 permit 10
     match ip address 10
    route-map r_teste permit 10
     match ip address 40
     set ip default next-hop 10.0.0.1
    control-plane
    line con 0
    line aux 0
    line vty 0 4
     login
    end
    R2#ping 192.168.55.1 source 195.0.0.1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.55.1, timeout is 2 seconds:
    Packet sent with a source address of 195.0.0.1
    Success rate is 0 percent (0/5)
    R2#sh access-lists
    Standard IP access list 10
        10 permit 192.168.0.0, wildcard bits 0.0.0.255
    Standard IP access list 20
        10 permit 192.168.1.0, wildcard bits 0.0.0.255
    Standard IP access list 30
        10 permit 195.0.0.0, wildcard bits 0.0.0.255
    Standard IP access list 40
        10 permit any
    Extended IP access list 100
        10 permit ip any 192.168.55.0 0.0.0.255
    R2#
    is possible without changing the bgp?
    thanks

    Default PBR:
    All packets received on an interface (ingress) with PBR enabled are entertained, first they should match through ACL then forward to next hop. if a match is exist (through ACL) but not forward to next hop then do nothing this packet especially for ICMP packet. 
    I think you need  Local PBR:
    Packets that are generated by the router are not normally policy-routed. To enable local PBR for such packets, indicate which route map the router should use by using the following command in global configuration mode:
    ip local policy route-map TEST
    Regards,
    kazim

  • Route-map, vlan routing

    I have a 6509 that I've setup with route-maps in order to route VLANs in different ways. For example, if we wanted some vlans to get out to the internet we would route them to a certain address. Then there is another vlan that we route to another internet gateway. It was all working pretty good until we swapped out another switch gateway in the network and every since things have been wonky. It seems as though the switch is routing packets that would normally stay on that switch out of the switch then back in, even though my access-list are set to deny the traffic. Here are the access-list and route-maps:
    access-list 10 permit 192.168.24.101
    access-list 10 permit 192.168.24.102
    access-list 100 permit tcp any 172.16.0.0 0.0.255.255 established
    access-list 100 permit tcp 192.168.4.0 0.0.3.255 host 172.16.1.10 eq www
    access-list 100 permit tcp 192.168.4.0 0.0.3.255 host 172.16.1.11 eq www
    access-list 104 permit ip host 172.16.4.11 host 65.54.150.19
    access-list 104 permit tcp host 172.16.4.20 any eq www
    ip access-list extended BITCENTRAL_INTERNET
     deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.4.0 0.0.3.255
     deny   ip 192.168.4.0 0.0.3.255 172.16.0.0 0.0.255.255
     permit ip host 172.16.1.170 any
     permit ip host 172.16.1.150 any
    ip access-list extended EDIT_BAYS
     deny   ip any 172.16.0.0 0.0.255.255
     deny   ip 172.16.0.0 0.0.255.255 any
     deny   ip 192.168.4.0 0.0.3.255 172.16.0.0 0.0.255.255
     permit ip host 192.168.25.2 any
     permit ip host 192.168.26.80 any
     permit ip host 192.168.25.104 any
     permit ip host 192.168.25.3 any
     permit ip host 192.168.26.69 any
     permit ip host 192.168.26.71 any
     permit ip host 192.168.27.33 any
    ip access-list extended ENPS
     deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.4.0 0.0.3.255
     deny   ip 192.168.4.0 0.0.3.255 172.16.0.0 0.0.255.255
     permit ip host 192.168.24.101 any
     permit ip host 192.168.24.102 any
     permit ip host 192.168.24.103 any
    ip access-list extended ENTRIQ
     deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.4.0 0.0.3.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.24.0 0.0.3.255
     deny   ip 192.168.24.0 0.0.3.255 172.16.0.0 0.0.255.255
     deny   ip 192.168.4.0 0.0.3.255 172.16.0.0 0.0.255.255
     permit ip 172.16.8.0 0.0.0.255 any
    ip access-list extended MISC
     deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.4.0 0.0.3.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.24.0 0.0.3.255
     deny   ip 192.168.24.0 0.0.3.255 172.16.0.0 0.0.255.255
     deny   ip 192.168.4.0 0.0.3.255 172.16.0.0 0.0.255.255
     permit ip 172.16.11.0 0.0.0.255 any
    ip access-list extended Omneon
     deny   ip 192.168.4.0 0.0.3.255 172.16.0.0 0.0.255.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.4.0 0.0.3.255
     deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
     permit ip host 172.16.2.11 any
     permit ip host 172.16.2.2 any
    ip access-list extended ROSS-VLAN
     deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
     deny   ip 172.16.0.0 0.0.255.255 192.168.4.0 0.0.3.255
     deny   ip 192.168.4.0 0.0.3.255 172.16.0.0 0.0.255.255
     permit ip host 172.16.4.20 any
     permit ip host 172.16.4.32 any
     permit ip host 172.16.4.31 any
     permit ip host 172.16.4.29 any
     permit ip host 172.16.4.30 any
     permit ip host 172.16.4.28 any
    vlan internal allocation policy ascending
    vlan access-log ratelimit 2000
    interface Vlan1
     no ip address
     shutdown
    interface Vlan10
     ip address 172.16.1.1 255.255.255.0
     ip policy route-map BITCENTRAL
    interface Vlan20
     ip address 172.16.2.1 255.255.255.0
     ip policy route-map OMNEON
    interface Vlan30
     ip address 172.16.3.1 255.255.255.0
    interface Vlan40
     ip address 172.16.4.1 255.255.255.0
     ip policy route-map ROSS-VLAN
    interface Vlan50
     ip address 172.16.5.1 255.255.255.0
    interface Vlan60
     ip address 172.16.6.1 255.255.255.0
    interface Vlan70
     ip address 172.16.7.1 255.255.255.0
    interface Vlan80
     ip address 172.16.8.1 255.255.255.0
     ip policy route-map ENTRIQ
    interface Vlan100
     ip address 192.168.27.1 255.255.252.0
     ip helper-address 192.168.7.255
     ip policy route-map OMNIBUS-VLAN
    interface Vlan110
     ip address 172.16.11.1 255.255.255.0
     ip helper-address 192.168.27.200
     ip policy route-map MISC
    interface Vlan120
     ip address 172.16.10.1 255.255.255.240
     ip policy route-map EDIT_BAYS
    interface Vlan140
     ip address 192.168.4.15 255.255.255.0
     ip directed-broadcast 10
    interface Vlan500
     ip address 192.168.1.19 255.255.255.224
    ip classless
    ip route 172.22.0.0 255.255.255.248 192.168.4.1
    ip route 192.168.0.0 255.255.255.224 192.168.4.254
    ip route 192.168.5.0 255.255.255.0 192.168.4.1
    route-map BITCENTRAL permit 60
     match ip address BITCENTRAL_INTERNET
     set ip next-hop 192.168.4.1
    route-map EDIT_BAYS permit 50
     match ip address EDIT_BAYS
     set ip next-hop 192.168.4.1
    route-map ENTRIQ permit 80
     match ip address ENTRIQ
     set ip next-hop 172.16.8.254
    route-map MISC permit 40
     match ip address MISC
     set ip next-hop 192.168.4.1
    route-map MSN permit 10
     match ip address 104
     set ip next-hop 192.168.4.1
    route-map OMNEON permit 20
     match ip address Omneon
     set ip next-hop 192.168.4.1
    route-map OMNIBUS-VLAN permit 30
     match ip address EDIT_BAYS
     set ip next-hop 192.168.4.1
    route-map OMNIBUS-VLAN permit 40
     match ip address ENPS
     set ip next-hop 192.168.4.1
    route-map ROSS-VLAN permit 70
     match ip address ROSS-VLAN
     set ip next-hop 192.168.4.1
    route-map SEC-VLAN permit 30
     match ip address SEC-VLAN
     set ip next-hop 192.168.4.1
    Here is how we tested the system and found the error. We cut the connection to 192.168.4.1 router, and when we try to ping a host on the 100 VLAN with the ip address of 192.168.24.101 from the MISC vlan with a ip address of 172.168.11.9 the ping just fails. When we enable the connection to the 192.168.4.1 router the pings go through again.  What in my route-map is causing this, I thought I setup the deny rules pretty good?

    Hi Mike,
    Between you and me, this is a lengthy config you have there.
    Next don't forget that a route-map doesn't apply to traffic originated or destined to the self-device, unless you use ip local policy in which might work, but there I have seen some nasty bugs.
    So if you can shorten your config to one example, then do the tests :
     - sourced from device A (it can be the SVI of another switch)
     - through your 6509 
     - destined to device B (it also can be the SVI of another switch, or even simpler some loopback inteface).

  • What is the second, third, etc. next-hop address in the route-map set command for?

    What is the second, third, etc. next-hop address in the route-map set command for?
    route-map TEST_PBR permit 10 match
    match ip address 101
    router(config-route-map)#set ip next-hop 1.1.1.1 ?
    A.B.C.D IP address of next hop

    Hi,
    You may get your answer in below link
    http://www.groupstudy.com/archives/ccielab/200812/msg00999.html
    First next-hop will be used unless until that is not unreachable. If first is unreachable, then next one will be used. Since these next-hops are directly connected, router can easily come to know whether they are active or not. In case you want to set some loopback ip as next-hop then you need to use keyword recursive "set ip next-hop recursive"
    --Pls dont forget to rate helpful posts--
    Regards,
    Akash

  • Local policy route-map for policy route

    Hi 
    this is related my previous question:
    I want to set policy route on asr1004, that redirect vpn traffic. 
    my case is:
      asr1004 import a default route 0.0.0.0 from int 0 with bgp neibour address 10.100.100.100
    assume internal traffic 10.10.10.0/24 coming into asr1004 on int 1.
    assume vpn with ip address 10.2.2.2 is direct linked to asr1004 int 2, and int 2 ip address is 10.2.2.1
    assume taget network is 10.200.200.0/24
    I want internal traffic (10.10.10.0/24) go to target (10.200.200.0/24)  to be redirect to10.2.2.2 (vpn)  first, so I add  "ip route 10.200.200.0/24 10.2.2.2" on asr1004.
    Than, I want vpn (10.2.2.2) encrypt traffic and send it to one of ip in10.200.200.0/24 range again. at this point if I put local policy route-map below, is it will work?
    ip local policy route-map vpn-out
    access-list 100 permit ip 10.2.2.2 any
    route-map vpn-out permit 10
      match ip address 100
      set ip next-hop 10.100.100.100
    if not, do I have any change to do policy route for this case?
    any comment will be appreciated
    Thanks in advance
    Julxu

    hi Jon
    can I refresh the question again:
    my case is:
      asr1004 import a default route 0.0.0.0 from int 0 with bgp neibour address 10.100.100.100
    assume internal traffic 10.10.0.0/16 coming into asr1004 on int 1 with ip address 10.3.3.3
    assume vpn with ip address 10.10.2.2 is direct linked to asr1004 int 2, and int 2 ip address is 10.10.2.1
    assume taget network is 10.200.200.0/24
    I want internal traffic (10.10.0.0/16) go to target (10.200.200.0/24)  to be redirect to10.10.2.2 (vpn)  first, so I add  "ip route 10.200.200.0/24 10.10.2.2" on asr1004.
    Than, I want vpn (10.10.2.2) encrypt traffic and send it to one of ip in10.200.200.0/24 range again. at this point if I put local policy route-map below, is it will work?
    ip local policy route-map vpn-out
    access-list 100 permit ip 10.10.2.2 any
    route-map vpn-out permit 10
      match ip address 100
      set ip next-hop 10.100.100.100
    such as:
    interface TenGigabitEthernet0/0/0
     description bgp to get default
     ip address 10.100.100.100 255.255.255.252
     no ip redirects
     no ip unreachables
     no ip proxy-arp
    interface TenGigabitEthernet0/1/0
     description get internaltraffic
     ip address 10.3.3.3 255.255.255.0
     no ip redirects
     no ip unreachables
     no ip proxy-arp
    interface GigabitEthernet0/2/1
     description vpn
     ip address 10.10.2.1 255.255.255.248
     no ip redirects
     no ip unreachables
     no ip proxy-arp
     media-type rj45
     negotiation auto
    ip local policy route-map vpn-out
    access-list 100 permit ip 10.10.2.2 any
    route-map vpn-out permit 10
      match ip address 100
      set ip next-hop 10.100.100.100
    ip route 10.200.200.0/24 10.10.2.2
    Could you please advise if it is correct?

  • Cisco 4900m, pbr, route-map

    Hi,
    My customer has a question, what is the limit for entries for the route-map for PBR that will be done in hardware? This applies to soft-4900M 12.2 (53) SG2. I need a reference to documentation.
    Regards,
    lb

    Hi Lukasz,
    the 4900M is a Data Center Switch and not a Metro one, so it is more appropriate if you post these types of questions on Network Infrastructure > LAN Switching and Routing section
    (the 4900M should not be confused with the ME4900 series, which are Metro switches instead).
    Anyway it supports 128.000 Security and Quality-of-Service (QoS) Hardware Entries as documented here:
    http://www.cisco.com/en/US/products/ps6021/prod_models_comparison.html
    and here:
    http://www.cisco.com/en/US/partner/prod/collateral/switches/ps5718/ps6021/ps9310/Data_Sheet_Cat_4900M.html
    regards,
    Riccardo

  • Understanding a route map

    Hi All,
    I have just taken over supporting a network, and have come accross a route map, that I don't really understand. The route-map is copied below. Can anyone please tell me step by step how its processed, and what the outcome is?
    route-map test permit 5
     match ip address prefix-list path_one_prefer
    route-map test permit 10
     match as-path 3
    route-map test permit 20
     match ip address prefix-list route-filter
     set as-path prepend 65100
    ip prefix-list path_one_prefer seq 5 permit 10.10.0.0/16
    ip as-path access-list 3 permit _65000_
    ip prefix-list route-filter seq 10 deny 172.130.1.0/28
    ip prefix-list route-filter seq 15 deny 172.131.1.248/29
    ip prefix-list route-filter seq 20 deny 172.200.128.0/27
    The route map is applied outbound towards an ebgp peer
    Many Thanks
    Russ

    Hello Russ,
    Yes that is indeed the case.
    route-map test permit 20
     match ip address prefix-list route-filter
     set as-path prepend 65100
    !ip prefix-list route-filter seq 10 deny 172.130.1.0/28
    ip prefix-list route-filter seq 15 deny 172.131.1.248/29
    ip prefix-list route-filter seq 20 deny 172.200.128.0/27
    In the route-map lines 20 - it is set to "match ip address prefix-list route-filter"
    Since the deny is in place in the prefix list, take it as "Not these ones"
    Everything else is permitted and AS-Path prepended.
    After line 20 there is no other - ACL logic - explicit deny - so if there is no match, its a deny, so the prefix's in the prefix-list "route-filter" are not advertised.
    This line 20 seems to be the "catch all" other routes except for these ones i.e. that prefix list, and prepend them.
    Check the routes you are advertising them as I stated in my first post with "show ip bgp neigh x.x.x.x advertised-routes" which should correlate with the route-map applied to your BGP peer.
    Hope this makes it clear.

Maybe you are looking for