Eigrp stub redistributed

Hi all,
Please see the below snippet of the EIGRP config from one of my routers.
router eigrp 1
network 1.1.1.24 0.0.0.0
network 10.10.200.0 0.0.0.255
network 10.10.201.0 0.0.0.255
network 172.18.24.0 0.0.0.255
network 172.18.124.0 0.0.0.255
redistribute static route-map STATIC-TO-EIGRP
passive-interface default
no passive-interface Tunnel0
no passive-interface Tunnel1
As you notice I am redistributing a static route-map.
If I add the eigrp stub redistributed command, it causes my router's inside IP to become unreachable even though I can still reach the router via the tunnel IP. Reason I want to add redistibuted to EIGRP is for the obvious reason that I want to advertise the static route-map. Will this work or is the redistributed keyword intended for something totally different?
Tanks

Ok so I discovered the reason for the above issue and am posting an answer here for future reference.
If you add eigrp stub alone, it automatically appends connected summary keywords which means it advertises the connected and summary routes and ignores all others. However if you specify eigrp stub redistributed alone as I was doing, the connected and summary routes get ignored therefore dropping the connect to the inside IP address.
Cheerios!

Similar Messages

Metrics when redistributing a static default route into EIGRP?

I saw a network working with EIGRP and resdistributing a static default route into it. I did not find the "default metrics" to redistribute into EIGRP but the static default route works and is redistributed. My understanding was that everytime you redistribute into EIGRP you needed to specify the metrics. How come this network is working? Can someone explain or point to a cisco document what explains it?
Sample of the config:
router eigrp 1
redistribute static
no autosummary
network Y.Y.Y.Y
ip route 0.0.0.0 0.0.0.0 X.X.X.X
Thank you,

It's just one of those specific things about EIGRP and IOS, maybe a design choice. If they do use the interface as the seed metric then that would help explain why it's that way.
Weirdly if you are using EIGRP VRF address family configuration on IOS and you redistribute statics you do need a metric.
And I believe NXOS running on Nexus switches also needs a metric defined.
Just one of those things you have to remember but it would be good if it was consistent.
Jon

Redistributing OSPF and eigrp

We have a medium size network consisting of 14 locations connected to one location via a mixture of T-1?s , fiber, wide area wireless and metro e. We us a mixture of Cisco and Dell switches.
We have run in to a problem combining the Cisco and the Dell and need some guidance.
The locations that come to us via the P2P T-1?s start at the branch locations on 2620 Cisco routers and run back to 3600 Cisco router ? we are currently using router eigrp to define our networks.
The problem that we are having at one location is that we have a layer 3 Dell switch behind the 2620 - the Dell switches will run OSPF and not Eigrp ? this there a way to have Eigrp advertise the the OSPF information it receives?
OR may be to sum it up better can you run Eigrp on the outside interface that passes OSPF from the internal interface?
Or is there a better way to do what I?m trying to do?
Any help is greatly welcome

Please see below config on the 2620:
ip subnet-zero
lane client flush
cns event-service server
interface FastEthernet0/0
ip address 10.100.187.1 255.255.255.0
duplex auto
speed auto
interface Serial0/0
description *** NEW T-1 to admin ***
ip address 10.100.181.10 255.255.255.252
no ip mroute-cache
no fair-queue
router eigrp 100
redistribute connected
redistribute ospf 1
network 10.0.0.0
no auto-summary
router ospf 1
network 10.100.0.0 0.0.255.255 area 0.0.0.0
ip classless
ip route 0.0.0.0 0.0.0.0 10.100.181.9
no ip http server
And on the 3600
interface Serial2/0
description *West Circuit ID 60.DHZ T-1
ip address 10.100.181.9 255.255.255.252
no cdp enable
router eigrp 100
network 10.100.178.0 0.0.0.255
network 10.100.181.0 0.0.0.3
network 10.100.181.4 0.0.0.3
network 10.100.181.8 0.0.0.3
network 10.100.181.12 0.0.0.3
network 10.100.181.16 0.0.0.3
network 10.100.181.20 0.0.0.3
network 10.100.181.24 0.0.0.3
network 10.100.181.28 0.0.0.3
no auto-summary
ip classless
ip route 0.0.0.0 0.0.0.0 10.100.177.2
ip route 10.100.150.0 255.255.254.0 10.100.181.10
ip route 10.100.152.0 255.255.254.0 10.100.181.10
ip route 10.100.154.0 255.255.254.0 10.100.181.10
ip route 10.100.154.0 255.255.255.0 10.100.181.10
ip route 10.100.155.0 255.255.255.0 10.100.181.10
ip route 10.100.158.0 255.255.255.0 10.100.181.10
ip route 10.100.187.0 255.255.255.0 10.100.181.10
ip route 10.100.188.0 255.255.255.0 10.100.181.10
ip route 10.100.190.0 255.255.255.0 10.100.181.10
ip route 10.100.192.0 255.255.255.0 10.100.181.10
ip route 10.100.199.0 255.255.255.0 10.100.181.6
ip http server
Thank you I will also review the link you sent.

How do you Redistribution EIGRP into OSPF and maintain a distance of 250 for a static route?

Ok, I have scoured the forums long enough and have to post. The design is below. I moved a firewall to our new data center, which required adding some static routes for VPN connections and broadband backups. To minimize the amount of static routes I redistribute static into EIGRP with a route-map and prefix-list.
My problem is the next part of my network. When the data leaves my 56128's it hits an edge device connecting to our dark fiber. On this edge device I am running OSPF onto the dark fiber, then redistribute some EIGRP subnets into OSPF and again all is well.
Everything works up until the point the redistributed routes hit my RIB at my main data center where I am running IBGP. IBPG is run between our MPLS router and core for all our remote sites. When my backup route from the 56128's hits the cores, it supersedes the BGP route because the AD route O E2 [110/20] is lower than the BGP AD B [200/0]. Given the configuration below what can be done to remedy this? Oh when I redistribute I can only change the AD for the backup routes, all other routes should stay the same.
56128's where my static routes are:
ip route 192.168.101.0/24 192.168.30.77 name firewall 250
router eigrp 65100
redistribute static route-map Static-To-Eigrp
route-map Static-To-Eigrp permit 10
match ip address prefix-list Static2Eigrp
ip prefix-list Static2Eigrp seq 2 permit 192.168.101.0/24
Edge device:
router eigrp 65100
network 172.18.0.5 0.0.0.0
network 172.18.0.32 0.0.0.3
network 172.18.0.36 0.0.0.3
redistribute ospf 65100 metric 2000000 0 255 1 1500
redistribute static metric 200000 0 255 1 1500 route-map STATICS_INTO_EIGRP
passive-interface default
no passive-interface Port-channel11
no passive-interface Port-channel12
eigrp router-id 172.18.0.5
router ospf 65100
router-id 172.18.0.5
log-adjacency-changes
redistribute eigrp 65100 subnets route-map EIGRP_INTO_OSPF
passive-interface default
no passive-interface GigabitEthernet1/0/1
no passive-interface GigabitEthernet1/0/2
no passive-interface GigabitEthernet2/0/1
no passive-interface GigabitEthernet2/0/2
network 172.18.0.0 0.0.255.255 area 0
ip prefix-list EIGRP_INTO_OSPF seq 5 permit 172.18.0.0/16 le 32
ip prefix-list EIGRP_INTO_OSPF seq 10 permit 192.168.94.0/29 le 32
ip prefix-list EIGRP_INTO_OSPF seq 15 permit 192.168.26.32/29 le 32
ip prefix-list EIGRP_INTO_OSPF seq 20 permit 192.168.30.72/29 le 32
ip prefix-list EIGRP_INTO_OSPF seq 25 permit 192.168.20.128/25 le 32
ip prefix-list EIGRP_INTO_OSPF seq 26 permit 192.168.101.0/24 le 32 <- Backup Route for MPLS Remote Office
route-map EIGRP_INTO_OSPF permit 10
match ip address prefix-list EIGRP_INTO_OSPF

So in the case of a /24. If it were say broken up into /25's? From our remote sites we are using aggregate-address summary-only. Not sure how I would advertise a more specific route via BGP, sorry.
I didnt have this problem until I moved my firewalls. They plugged into the cores where IBGP was running and the static never kicked in unless the bgp route disappeared. I guess I could use my static redistribution for my VPN sites and use statics across the cores for the handful of backup links I have.

EIGRP Routing across MPLS Cloud

I appologize if this has been covered but I dont see any exact hits...
We are working with our Service Provider to implement MPLS between our remote sites and main campus. We are currently using PtoP T1 in a hub and spoke model. We are running EIGRP in our entire environment.
We would like to continue to run EIGRP in our environment but the SP does not support this protocol through the cloud. I would prefer not to introduce any new routing protocols into our environment such as BGP. (I believe SP is running BGP).
I have read snippits that I can us e GRE tunnel between sites and send EIGRP routing updates via this tunnel.
Can anyone support this method or are there better alternatives? If I implement GRE, I will still need to configure static routes so GRE knows how to reach the remote sites. I also cannot find any literature on how to configure GRE tunnels and use them ONLY for routing updates. I would think sending all traffic via GRE would cause additional overhead.
I will also have a need to send Multicast traffic between sites. I have read that GRE is the way to do this. To me it seems GRE will serve dual purposes.. first to allowing Dynamic routing updates between sites and also to allow Multicast traffic.
I appreciate any comments or suggestions!

Hello Phil,
using GRE tunnels to build an overlay would deny one of the greatest benefits of MPLS L3 VPN: the peer model where each CE talks only with local PE node.
unless you have a small number of sites this approach is not recommended.
What if a new site is added in the future? you would need to configure a tunnel GRE to the new site in each of the existing sites.
You could run a DMVPN ( that is to use mGRE) to solve this but it has some complexity.
You can run BGP without using mutual redistribution: BGP allows to advertise internal networks using the network command even if they are not directly connected to the CE router but learned via EIGRP.
So it is enough to redistribute only BGP into EIGRP by setting a default seed metric (it requires five values in EIGRP and it is necessary or redistribution will not occur)
router bgp 65001
neigh PE-address remote-as SP-AS-number
network 10.10.10.0 mask 255.255.255.0
network 10.10.20.0 mask 255.255.254.0
no auto-summary
! note:if auto-summary is disabled you need to provide the exact mask / prefix length
router eigrp 100
redistribute bgp 65001
default-metric 10000 1000 255 1 1500
! BW delay reliabilty load MTU
Hope to help
Giuseppe

EIGRP summarization don't works

Hello everyone.
I have a lot of branches with a lot of small networks (around 14 networks at each branch):
C 10.0.0.112/28 is directly connected, FastEthernet0/0.7
C 10.0.0.96/29 is directly connected, FastEthernet0/0.2
C 10.0.0.80/28 is directly connected, FastEthernet0/0.11
C 10.0.0.64/28 is directly connected, FastEthernet0/0.4
C 10.0.0.56/29 is directly connected, FastEthernet0/0.21
C 10.0.0.48/29 is directly connected, FastEthernet0/0.8
C 10.0.0.32/28 is directly connected, FastEthernet0/0.51
C 10.0.0.24/29 is directly connected, FastEthernet0/0.20
C 10.0.0.16/29 is directly connected, FastEthernet0/0.16
C 10.0.0.8/29 is directly connected, FastEthernet0/0.5
C 10.0.0.4/30 is directly connected, FastEthernet0/0.3
C 10.0.0.0/30 is directly connected, FastEthernet0/0.15
C 10.0.0.192/26 is directly connected, FastEthernet0/0.50
C 10.0.0.128/26 is directly connected, FastEthernet0/0.17
So I want to use route summarization to send 1 route insteand of 14. After using command "ip summary-address eigrp" at the interface I see that branch router create a summarization route:
D 10.0.0.0/24 is a summary, 15:26:01, Null0
The sceme of connection looks like this:
But the central router still gets routes from branch router like this:
D 10.0.0.0/30 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.4/30 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.8/29 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.16/29 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.24/29 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.32/28 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.48/29 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.56/29 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.64/28 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.80/28 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.96/29 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.112/28 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.128/26 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
D 10.0.0.192/26 [90/1286912] via 172.2.0.68, 12:30:09, Tunnel1
Configuration of EIGRP at the branch side:
interface Tunnel1
ip summary-address eigrp 1 10.0.0.0 255.255.255.0 90
router eigrp 1
passive-interface default
no passive-interface Tunnel1
network 10.0.0.0 0.0.255.255
network 172.2.0.0 #Tunnel interface network
no auto-summary
eigrp stub connected
Configuration of EIGRP at central router:
interface Tunnel1
no ip split-horizon eigrp 1
router eigrp 1
passive-interface default
no passive-interface Tunnel1
network 172.2.0.0 #Tunnel interface network
no auto-summary
Additional information: I'm using DmVPN (without spoke to spoke connections) for connection between the routers. Central router is 3925 (IOS c3900-universalk9-mz.SPA.152-4.M6a) and branch router is 2801 (IOS c2800nm-advsecurityk9-mz.151-4.M7).
Thanks in advance for any help.
Best Regards.

Hello,
Your EIGRP stub routers (the branch routers) are currently configured with eigrp stub connected command. This command allows the stub router to advertise only directly connected networks. Even if address summarization is configured, the stub is not allowed to advertise the summary address.
The correction should be fairly simple: replace the eigrp stub connected command with eigrp stub connected summary on your branch routers. This should do the trick.
Please be aware that your EIGRP adjacencies may momentarily flap when you enter the eigrp stub connected summary - please accomodate the time of this change to a period of day where the connectivity outage of a couple of seconds is acceptable.
Best regards,
Peter

Redistributing Routes based on TAGS

Hi,
I have a bunch of static routes I am RD'ing into OSPF and marking with a tag of 123
I want to then RD these routes ( only routes marked with tag 123) into EIGRP.
Can I achieve this with a route-map and a command in my EIGRP statement?
I'll start with
route-map RD-123 permit 10
match tag 123
Do I then need to deny everything else with another sequence number?
Can I achieve what I am trying to do above?
Thanks

Hi,
yes, you can do that.
If you redistribute your static routes to OSFP tagging with 123 on one router, you can then configure on another router:
router eigrp x
redistribute ospf y route-map RD-123
uisng your route-map suggested in your original post. You deon't need any deny entry in the route-map.
You can even use
redistribute ospf y match external 2 route-map RD-123
to be safer.
Best regards,
Milan

Catalyst 4500, supervisor II+, EIGRP

Hi,
We're bought a catalyst 4500 sup II+ with image cat4000-i9s-mz.122-25.EWA4.bin
In feature navigator isn't anything about EIGRP in this image, but in CLI I may configure EIGRP.
How is that possible?
thx

Hi,
You can only configure the EIGRP stub on the Sup 2+. EIGRP fully is not supported on sup2+.
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat4000/12_2_31s/conf/l3_int.htm#wp1042868
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_data_sheet09186a0080197424.html
HTH, Please rate if it does.
-amit singh

Bgp-Eigrp-Bgp redistribution question

Hi Experts,
Just wish to ask if there is an option to retain the as-path information in eigrp when i redistribute from bgp to eigrp then to bgp?
I recall coming across something similar to this before but I can't seem to remember it.
Thanks in advance.

Hello friend.
No, you can't retain the AS-PATH when redistributing prefixes from BGP to EIGRP.
What you CAN do though, is to add the AS-PATH you want when redistributing it BACK to BGP.
You can do something like this:
1 - Add a TAG when redistributing the BGP prefixes into EIGRP
route-map SET_TAG permit 10
set tag 100
router eigrp 1
redistribute bgp 100 metric 1 1 1 1 1 route-map SET_TAG
2 - transform the TAG into an AS_PATH, when redistributing it BACK to BGP.
route-map set-as-path-from-tag
set as-path tag
router bgp 100
redistribute eigrp 1 route-map set-as-path-from-tag
Got it ?
I hope this helps you !
cheers

OSPF redistribution into EIGRP

Hello, I have router 5 and router 7 as OSPF neighbours connected via area 24.
Router 5 is running EIGRP and OSPF. Router 7 is only running OSPF. I am trying to redistribute the OSPF route 172.16.100.0/25 from router 7 into router 5's EIGRP instance.
However, I cannot seem to redistribute that network into Router 5.
Can someone please take a quick look at the configs below. I am sure it is something simple.
Thank you kindly for any help.
ROUTER 5 (EIGRP and OSPF)
ip cef
no ipv6 cef
license udi pid CISCO2911/K9 sn FTX1524HT0O
spanning-tree mode pvst
interface GigabitEthernet0/0
ip address 192.168.3.1 255.255.255.0
duplex auto
speed auto
interface GigabitEthernet0/1
ip address 192.168.1.1 255.255.255.0
duplex auto
speed auto
interface GigabitEthernet0/2
ip address 192.168.2.1 255.255.255.0
duplex auto
speed auto
interface Vlan1
no ip address
shutdown
router eigrp 100
redistribute ospf 1 metric 1000000 10 255 1 1500
network 192.168.2.0
network 192.168.1.0
auto-summary
router ospf 1
log-adjacency-changes
redistribute eigrp 100 metric-type 1 subnets
network 192.168.3.0 0.0.0.255 area 24
ip classless
ip flow-export version 9
line con 0
line aux 0
line vty 0 4
login
end
ROUTER 7 (only OSPF)
hostname Router
ip cef
no ipv6 cef
license udi pid CISCO2911/K9 sn FTX1524D5LZ
spanning-tree mode pvst
interface GigabitEthernet0/0
ip address 192.168.3.2 255.255.255.0
duplex auto
speed auto
interface GigabitEthernet0/1
ip address 172.16.100.1 255.255.255.0
duplex auto
speed auto
interface GigabitEthernet0/2
ip address 192.168.4.2 255.255.255.0
duplex auto
speed auto
interface Vlan1
no ip address
shutdown
router ospf 1
log-adjacency-changes
network 172.16.100.0 0.0.0.255 area 44
network 192.168.3.0 0.0.0.255 area 24
network 192.168.4.0 0.0.0.255 area 34
ip classless
ip flow-export version 9
line con 0
line aux 0
line vty 0 4
login
end

here is show ip route from router 5:
" 192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.1.0/24 is directly connected, GigabitEthernet0/1
L 192.168.1.1/32 is directly connected, GigabitEthernet0/1
192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.2.0/24 is directly connected, GigabitEthernet0/2
L 192.168.2.1/32 is directly connected, GigabitEthernet0/2
192.168.3.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.3.0/24 is directly connected, GigabitEthernet0/0
L 192.168.3.1/32 is directly connected, GigabitEthernet0/0
D EX 192.168.4.0/24 [105/5376] via 192.168.2.2, 01:26:47, GigabitEthernet0/2"
Here is show ip route from router 7:
172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C 172.16.100.0/24 is directly connected, GigabitEthernet0/1
L 172.16.100.1/32 is directly connected, GigabitEthernet0/1
O E1 192.168.1.0/24 [110/21] via 192.168.3.1, 01:43:21, GigabitEthernet0/0
[110/21] via 192.168.4.1, 01:41:43, GigabitEthernet0/2
O E1 192.168.2.0/24 [110/21] via 192.168.3.1, 01:43:21, GigabitEthernet0/0
[110/21] via 192.168.4.1, 01:41:43, GigabitEthernet0/2
192.168.3.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.3.0/24 is directly connected, GigabitEthernet0/0
L 192.168.3.2/32 is directly connected, GigabitEthernet0/0
192.168.4.0/24 is variably subnetted, 2 subnets, 2 masks
C 192.168.4.0/24 is directly connected, GigabitEthernet0/2
L 192.168.4.2/32 is directly connected, GigabitEthernet0/2

EIGRP Config

Hi,
I am facing a problem to configure EIGRP in Cisco 1841 Routers. Only directly connected network are announce between two routers. But I need the 10.30.1.0/24 route info in R2 router. Does it possible or not?
Here the EIGRP config
R1 config
router eigrp 11
network 10.30.13.0 0.0.0.255
network 10.30.1.0 0.0.0.255
network 10.10.10.4 0.0.0.3
network 10.10.10.0 0.0.0.3
no auto-summery
R2 config
router eigrp 11
network 10.11.28.0 0.0.0.255
network 10.10.10.4 0.0.0.3
no auto-summery
Please see the attachment for more details. Let me know if you have any question.
Regards,
Mamun

The network statement under your eigrp config does not tell the router to advertise that network. So you have
router eigrp 11
network 10.30.1.0 0.0.0.255
but the network statement under EIGRP tells the router which interfaces to run EIGRP on. And R1 does not have an interface in that network, because it is behind firewall.
So, how does R1 know how to get to 10.30.1.0/24 network ? Do you have a static route on R1 such as
ip route 10.30.1.0 255.255.255.0 <10.10.10.x> where .x is the firewall interface IP address on the 10.10.10.x network ?
If so do the following
1) remove the network statement from your eigrp config - it's not doing anything
router eigrp 11
no network 10.30.1.0 0.0.0.255
2) If you are using a static under your eigrp config
router eigrp 11
redistribute static
If you are not using a static route on R1 let me know what are you using on R1.
Jon

How to reduce EIGRP traffic

Dear All
There is a network where there are one data center and more than 200 branch office networks. They are connected with each other through EIGRP over MPLS. We can imagine there are a lot EIGRP traffic in there. My question is that what is a good way to summarize all the traffic ? Thank you.
yangfrank

Thank you for your reply.
Can we use command "ip summary-address " under the interface which is connected to MPLS PE ?
In addition, can we use eigrp stub or use the stub with " ip summary-address eigrp 1 x.x.x.x x.x.x.x" ?

Cisco 2620 eigrp/ospf issues

Greetings,
I'm having issues getting a Cisco 2620 and a Dell Powerconnect 6024 to redistribute via eigrp/ospf correctly which are both at a remote location. I have attached a basic diagram to better show the topology. We have been unable to access the remote site from our main site (which is using a cisco 3600) without a static route for each subnet at the remote site. Hopefully this makes sense.
Cisco 2620 Config:
Building configuration...
Current configuration:
ip subnet-zero
lane client flush
cns event-service server
interface FastEthernet0/0
ip address 10.100.187.1 255.255.255.0
duplex auto
speed auto
interface Serial0/0
ip address 10.100.181.10 255.255.255.252
no ip mroute-cache
no fair-queue
router eigrp 100
redistribute connected
redistribute ospf 1
network 10.0.0.0
no auto-summary
router ospf 1
redistribute connected
redistribute eigrp 100 subnets
network 10.100.0.0 0.0.255.255 area 0.0.0.0
ip classless
ip route 0.0.0.0 0.0.0.0 10.100.181.9
no ip http server
banner motd ^CCC

Timothy
There are a couple of things that I am not clear about concerning your situation. Your diagram shows a single subnet between the Cisco and the Dell. Is everything in the Dell in that single subnet? If so I am not sure why you are running OSPF, since there will not be any OSPF routes to redistribute.
If the diagram is incomplete and there are routes in OSPF that need to redistribute to EIGRP then there is an issue in the configuration. There is no default metric configured under router EIGRP. Without a default metric routes from another protocol (OSPF) will not redistribute into EIGRP.
I think it is also an interesting question whether the 2620 and the 3600 routers are forming EIGRP neighbor relationships. Failure to form EIGRP neighbor relationships could also cause the symptoms that you describe.
HTH
Rick

WCCP not redirecting packets

Hello,
I am trying to redirect packets to a bluecoat proxy sg using WCCP on a 3750x stack with IP services.
I cant get the packets to redirect.
The bluecoat device is on the same vlan as the client traffic that I am trying to redirect.
It seems that when I apply the redirect on the vlan interface, the Bluecoat can see the traffic though.
(After it is applied, I can no longer access the websites, but the bluecoat device shows some activity)
SDM prefer is enabled.
Here is the config:
SiteA#sh run
Building configuration...
Current configuration : 7699 bytes
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname SiteA
boot-start-marker
boot-end-marker
enable secret 5 $1$V1w8$6bmKd6oXWk//FH7/BaoFG.
username systemsgo privilege 15 secret 5 $1$vu8O$1uMdtS1Gzk12.YT3RObZO1
no aaa new-model
switch 1 provision ws-c3750x-24
switch 2 provision ws-c3750x-24
system mtu routing 1500
ip routing
ip wccp 90 redirect-list 115 group-list 15
vtp mode transparent
track 1 ip sla 1 reachability
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
vlan 10
ip ssh version 2
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
interface FastEthernet0
no ip address
no ip route-cache cef
no ip route-cache
interface GigabitEthernet1/0/1
no switchport
ip address 192.168.20.2 255.255.255.252
speed 100
duplex full
interface GigabitEthernet1/0/2
no switchport
ip address 192.168.20.9 255.255.255.252
interface GigabitEthernet1/0/3
switchport access vlan 10
switchport mode access
interface GigabitEthernet1/1/1
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
interface GigabitEthernet2/0/1
description *BlueCoat Proxy*
switchport access vlan 10
switchport mode access
interface GigabitEthernet2/0/2
switchport access vlan 10
switchport mode access
interface GigabitEthernet2/1/1
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode active
interface GigabitEthernet2/1/2
interface GigabitEthernet2/1/3
interface GigabitEthernet2/1/4
interface TenGigabitEthernet2/1/1
interface TenGigabitEthernet2/1/2
interface Vlan1
no ip address
interface Vlan10
ip address 10.10.20.3 255.255.255.0
standby 10 ip 10.10.20.1
standby 10 priority 110
standby 10 preempt
ip wccp 90 redirect in
router eigrp 1
network 10.10.20.0 0.0.0.255
network 192.168.10.0
network 192.168.20.0 0.0.0.3
redistribute static
ip local policy route-map IP_SLA_SiteA
ip http server
ip http secure-server
ip route 0.0.0.0 0.0.0.0 192.168.20.10 track 1
ip sla 1
icmp-echo 4.2.2.2 source-ip 192.168.20.9
threshold 300
frequency 15
ip sla schedule 1 life forever start-time now
ip sla enable reaction-alerts
logging esm config
access-list 15 permit 10.10.20.220
access-list 101 permit icmp host 192.168.20.9 host 4.2.2.2
access-list 115 permit tcp 10.20.20.0 0.0.0.255 any eq www
access-list 115 permit tcp 10.20.20.0 0.0.0.255 any eq 443
access-list 115 permit tcp 10.10.20.0 0.0.0.255 any eq 443
access-list 115 permit tcp 10.10.20.0 0.0.0.255 any eq www
access-list 115 permit tcp 192.168.20.0 0.0.0.255 any eq www
access-list 115 permit tcp 192.168.20.0 0.0.0.255 any eq 443
route-map IP_SLA_SiteA permit 10
match ip address 101
set ip next-hop 192.168.20.10
SiteA#
SiteA#show ip wccp 90
Global WCCP information:
    Router information:
        Router Identifier:                   192.168.20.9
        Protocol Version:                    2.0
    Service Identifier: 90
        Number of Service Group Clients:     1
        Number of Service Group Routers:     1
        Total Packets s/w Redirected:        0
          Process:                           0
          CEF:                               0
        Redirect access-list:                115
        Total Packets Denied Redirect:       52389
        Total Packets Unassigned:            71
        Group access-list:                   15
        Total Messages Denied to Group:      0
        Total Authentication failures:       0
        Total GRE Bypassed Packets Received: 0
SiteA#show ip wccp 90 detail
WCCP Client information:
        WCCP Client ID:          10.10.20.220
        Protocol Version:        2.0
        State:                   Usable
        Redirection:             L2
        Packet Return:           GRE
        Packets Redirected:    0
        Connect Time:          00:19:36
        Assignment:            MASK
        Mask SrcAddr    DstAddr    SrcPort DstPort
        0000: 0x00000000 0x0000003F 0x0000 0x0000
        Value SrcAddr    DstAddr    SrcPort DstPort CE-IP
        0000: 0x00000000 0x00000000 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0001: 0x00000000 0x00000001 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0002: 0x00000000 0x00000002 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0003: 0x00000000 0x00000003 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0004: 0x00000000 0x00000004 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0005: 0x00000000 0x00000005 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0006: 0x00000000 0x00000006 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0007: 0x00000000 0x00000007 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0008: 0x00000000 0x00000008 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0009: 0x00000000 0x00000009 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0010: 0x00000000 0x0000000A 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0011: 0x00000000 0x0000000B 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0012: 0x00000000 0x0000000C 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0013: 0x00000000 0x0000000D 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0014: 0x00000000 0x0000000E 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0015: 0x00000000 0x0000000F 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0016: 0x00000000 0x00000010 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0017: 0x00000000 0x00000011 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0018: 0x00000000 0x00000012 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0019: 0x00000000 0x00000013 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0020: 0x00000000 0x00000014 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0021: 0x00000000 0x00000015 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0022: 0x00000000 0x00000016 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0023: 0x00000000 0x00000017 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0024: 0x00000000 0x00000018 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0025: 0x00000000 0x00000019 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0026: 0x00000000 0x0000001A 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0027: 0x00000000 0x0000001B 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0028: 0x00000000 0x0000001C 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0029: 0x00000000 0x0000001D 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0030: 0x00000000 0x0000001E 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0031: 0x00000000 0x0000001F 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0032: 0x00000000 0x00000020 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0033: 0x00000000 0x00000021 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0034: 0x00000000 0x00000022 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0035: 0x00000000 0x00000023 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0036: 0x00000000 0x00000024 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0037: 0x00000000 0x00000025 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0038: 0x00000000 0x00000026 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0039: 0x00000000 0x00000027 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0040: 0x00000000 0x00000028 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0041: 0x00000000 0x00000029 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0042: 0x00000000 0x0000002A 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0043: 0x00000000 0x0000002B 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0044: 0x00000000 0x0000002C 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0045: 0x00000000 0x0000002D 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0046: 0x00000000 0x0000002E 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0047: 0x00000000 0x0000002F 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0048: 0x00000000 0x00000030 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0049: 0x00000000 0x00000031 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0050: 0x00000000 0x00000032 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0051: 0x00000000 0x00000033 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0052: 0x00000000 0x00000034 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0053: 0x00000000 0x00000035 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0054: 0x00000000 0x00000036 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0055: 0x00000000 0x00000037 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0056: 0x00000000 0x00000038 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0057: 0x00000000 0x00000039 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0058: 0x00000000 0x0000003A 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0059: 0x00000000 0x0000003B 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0060: 0x00000000 0x0000003C 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0061: 0x00000000 0x0000003D 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0062: 0x00000000 0x0000003E 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
        0063: 0x00000000 0x0000003F 0x0000 0x0000 0x0A0A14DC (10.10.20.220)
SiteA#
SiteA#sh sdm prefer
The current template is "desktop routing" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.
number of unicast mac addresses:                  3K
number of IPv4 IGMP groups + multicast routes:    1K
number of IPv4 unicast routes:                    11K
    number of directly-connected IPv4 hosts:        3K
    number of indirect IPv4 routes:                 8K
number of IPv4 policy based routing aces:         0.5K
number of IPv4/MAC qos aces:                      0.5K
number of IPv4/MAC security aces:                 1K
SiteA#

Hi Jon,
There are no more throughput issues.
Everything is working well. Thanks so much!
As for the WCCP,
I put the redirect acl on the L3 ports that connect back to 3750_3, but it is still not catching the traffic from the user vlan 20 on 3750_3. (We did however get it working for the server vlan in Site1 and Site2)
I'm not sure what you meant when you said:
Then you simply use site1 or site2's devices for web traffic.
Do I need to change the gateway for the users vlan in Site 3750_3 to something else?
Right now it is pointing to 10.20.20.1 on the 3750_3.
Below is what I have so far on the 3750_3.
I tried to force the traffic via PBR to the BlueCoat device, but that didnt seem to work either.
UserSite(config)#do sh run
Building configuration...
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname UserSite
boot-start-marker
boot-end-marker
no aaa new-model
switch 1 provision ws-c3750x-48p
switch 2 provision ws-c3750x-48p
system mtu routing 1500
ip routing
vtp mode transparent
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
vlan 10
vlan 20
name clients
interface FastEthernet0
no ip address
no ip route-cache cef
no ip route-cache
no ip mroute-cache
interface GigabitEthernet1/0/47
description *CERTES-MGMT-MAIN*
switchport access vlan 20
switchport mode access
interface GigabitEthernet1/0/48
description *MAN-LINE-TO-DC-MAIN*
no switchport
ip address 192.168.20.1 255.255.255.252
speed 100
duplex full
interface GigabitEthernet1/1/1
interface GigabitEthernet1/1/2
interface GigabitEthernet1/1/3
interface GigabitEthernet1/1/4
interface TenGigabitEthernet1/1/1
interface TenGigabitEthernet1/1/2
interface GigabitEthernet2/0/47
description *CERTES-MGMT-DR*
switchport access vlan 20
switchport mode access
interface GigabitEthernet2/0/48
description *MAN-LINE-TO-DC-DR*
no switchport
ip address 192.168.20.5 255.255.255.252
speed 100
duplex full
interface GigabitEthernet2/1/1
interface GigabitEthernet2/1/2
interface GigabitEthernet2/1/3
interface GigabitEthernet2/1/4
interface TenGigabitEthernet2/1/1
interface TenGigabitEthernet2/1/2
interface Vlan1
ip address 192.168.10.254 255.255.255.0
interface Vlan20
ip address 10.20.20.1 255.255.255.0
ip helper-address 10.10.20.30
router eigrp 1
network 10.20.20.0 0.0.0.255
network 192.168.10.0
network 192.168.20.0 0.0.0.7
offset-list 10 in 100 GigabitEthernet2/0/48
eigrp stub connected summary
ip local policy route-map PBR_Proxy
ip classless
ip http server
ip http secure-server
ip access-list extended Traffic2Proxy
permit tcp 10.20.20.0 0.0.0.255 eq www any
permit tcp 10.20.20.0 0.0.0.255 eq 443 any
ip sla enable reaction-alerts
route-map PBR_Proxy permit 10
match ip address Traffic2Proxy
set ip next-hop 192.168.50.220
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
login local
line vty 0 4
exec-timeout 30 0
privilege level 15
logging synchronous
login local
length 0
transport input telnet ssh
line vty 5 15
exec-timeout 30 0
privilege level 15
logging synchronous
login local
transport input telnet ssh
end

WS-C3750X-24S - FastEthernet0 question

Hello all,
I have a C3750X-24S and i configured FastEthernet0 with ip address (10.251.157.2) and 10.251.157.1 is connected to a firewall (firewall allowed any-any now). Firewall has default route to 10.251.157.2 configured.
Switch is connected to WAN router and running EIGRP.
I am able to ping to 10.251.157.1 from switch, and extended ping from other interfaces of switch to 10.251.157.1 looks fine as well.
I am able to ping to 10.251.157.2(switch) from remote location without problem as well.
But i am not able to ping to 10.251.157.1 from remote location, traceroute stop at that switch interface.
i am able to ping to 10.251.157.2 from local WAN router, but not able to ping to 10.251.157.1. Trace stop at switch as well.
Below the "eigrp", interface f0 and "sh ver" output. Kindly please help advise what went wrong. Thanks.
interface FastEthernet0
ip address 10.251.157.2 255.255.255.248
no ip route-cache cef
no ip route-cache
end
router eigrp 1
network 10.0.0.0
redistribute static
eigrp stub connected summary
switch#sh ver
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (f
c1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Thu 21-Jul-11 01:23 by prod_rel_team
ROM: Bootstrap program is C3750E boot loader
BOOTLDR: C3750E Boot Loader (C3750X-HBOOT-M) Version 12.2(58r)SE1, RELEASE SOFTWARE (fc1)
switch uptime is 12 weeks, 3 days, 18 hours, 42 minutes
System returned to ROM by power-on
System image file is "flash:/c3750e-universalk9-mz.122-58.SE2/c3750e-universalk9-mz.122-58.SE2.bin"
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
License Level: ipbase
License Type: Permanent
Next reload license Level: ipbase
cisco WS-C3750X-24S (PowerPC405) processor (revision M0) with 524288K bytes of memory.
Processor board ID FDO1828R17B
Last reset from power-on
18 Virtual Ethernet interfaces
1 FastEthernet interface
28 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.
512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : 7C:0E:CE:4F:D4:00
Motherboard assembly number     : 73-13061-06
Motherboard serial number       : FDO18281DC2
Model revision number           : M0
Motherboard revision number     : A0
Model number                    : WS-C3750X-24S-S
Daughterboard assembly number   : 800-32727-03
Daughterboard serial number     : FDO18281FKC
System serial number            : FDO1828R17B
Top Assembly Part Number        : 800-33746-06
Top Assembly Revision Number    : B0
Version ID                      : V05
CLEI Code Number                : CMMP200DRA
Hardware Board Revision Number : 0x05
Switch Ports Model              SW Version            SW Image
*    1 30    WS-C3750X-24S      12.2(58)SE2           C3750E-UNIVERSALK9-M
Configuration register is 0xF
Regards,
Christopher

Christopher
As far as I am aware you cannot use that port for normal traffic, it is only for management.
So traffic can't be routed through the switch using that port.
Try using one of the other ports.
Jon

Eigrp stub redistributed

Similar Messages

Maybe you are looking for