If support dynamic routing protocol?

Hi, guys
I know RRAS can support only RIP protocol. However, I cant find any way to configure dynamic routing protocol on TMG, some people say TMG cant support that even rip. That’s right? Is it possible or is there any plug-in can help TMG to do that?
Nice Day

Hi,
Thank you for your post here.
As far as I know, it is impossible to do that. By default, TMG does not support it.
http://technet.microsoft.com/en-us/library/ee796231.aspx#t4t4e4t
Best Regards
Quan Gu

Similar Messages

Good CCIE question: Can multiple site-2-site VPNs support dynamic routing protocols?

Hi All,
Was not sure if this should be posted in LAN routing, WAN routing or VPN forums: I have posted here as the VPN tunnels are the limiting factors...
I am trying to understand if it is possible to have dynamic routing between LANs when using site to site VPNs on three or more ASA55x5-x (9.0).
To best explain the question I have put together an example scenario:
Lets say we have three sites, which are all connected via a separate site-2-site IKEv2 VPNs, in a full mesh topology (6 x SAs).
Across the whole system there would be a 192.168.0.0/16 subnet which is divided up by VLSM across all sites.
The inside / outside interfaces of the ASA would be static IPs from a /30 subnet.
Routing on the outside interface is not of concern in this scenario.
The inside interface of the ASA connects directly to a router, which further uses VLSM to assign additional subnets.
VLSM is not cleanly summarised per site. (I know this flys against VLSM best practice, but makes the scenario clearer...)
New subnets are added and removed at each site on a frequent basis.
EIGRP will be running on each core router, and any stub routers at each site.
So this results in the following example topology, of which I have exaggerated the VLSM position:
(http://www.diagram.ly/?share=#OtprIYuOeKRb3HBV6Qy8CL8ZUE6Bkc2FPg2gKHnzVliaJBhuIG)
Now, using static route redistribution from the ASAs into EIGRP and making the ASAs to be an EIGRP neighbour, would be one way. This would mean an isolated EIGRP AS per site, but each site would only learn about a new remote subnet if the crypto map match ACL was altered. But the bit that I am confused over, is the potential to have new subnets added or removed which would require EIGRP routing processes on the relevant site X router to be altered as well as crypto map ACLs being altered at all sites. This doesn't seem a sensible approach...
The second method could be to have the 192.168.0.0/16 network defined in the crypto map on all tunnels and allow the ASAs routing table to chose which tunnel to send the traffic over. This would require multiple neighbours for the ASA, but for example in OSPF, it can only support one neighbour over a S2S VPN when manually defined (point-to-point). The only way round this I can see is to share our internal routing tables with the IP cloud, but this then discloses information that would be otherwise protected by the IPSEC tunnel...
Is there a better method to propagate the routing information dynamically around the example scenario above?
Is there a way to have dynamic crypto maps based on router information?
P.S. Diagram above produced via http://www.diagram.ly/

Hi Guys,
Thanks for your responses! I am learning here, hence the post.
David: I had looked in to the potential for GRE tunnels, but the side-effects could out weight the benifits. The link provided shows how to pass IKEv1 and ISAKMP traffic through the ASA. In my example (maybe not too clear?) the IPSEC traffic would be terminated on the ASA and not the core router behind.
Marcin: Was looking at OSPF, but is that not limited to one neighbour, due to the "ospf network point-to-point non-broadcast" command in the example (needed to force the unicast over the IPSEC tunnel)? Have had a look in the ASA CLI 9.0 config guide and it is still limited to one neighbour per interface when in point-to-point:
ospf network point-to-point non-broadcastSpecifies the interface as a point-to-point, non-broadcast network.When you designate an interface as point-to-point and non-broadcast, you must manually define the OSPF neighbor; dynamic neighbor discovery is not possible. See the "Defining Static OSPFv2 Neighbors" section for more information. Additionally, you can only define one OSPF neighbor on that interface.
Otherwise I would agree it would be happy days...
Any other ideas (maybe around iBGPs like OSPF) which do not envolve GRE tunnels or terminating the IPSEC on the core router please?
Kindest Regards,
James.

Dynamic Routing Protocol Support in Cisco ASA Multiple Context Mode

                   Dear Experts,
Wold like to know whether dynamic Routing Protocol Support in Cisco ASA Firewall Multiple Context Mode. If yes then please provide OS version and Hardware Model of Cisco ASA Firewall. Appreciate the quick response. Thanks.

Hi,
Check out this document for the information
http://www.cisco.com/en/US/docs/security/asa/roadmap/asa_new_features.html#wp93116
Its lists the following for software level 9.0(1)
Multiple   Context Mode Features
Dynamic routing in Security   Contexts
EIGRP and OSPFv2 dynamic   routing protocols are now supported in multiple context mode. OSPFv3, RIP, and multicast routing   are not supported.
Seems to me you would need some 9.x version to support the above mentioned Dynamic Routing Protocols.
I don't think its related to the hardware model of the ASA other than that it requires a model that supports Multiple Context Mode. To my understanding the only model that doesnt support that is ASA5505 of the whole ASA5500 and ASA5500-X series.
Hope this helps
- Jouni

Dynamic routing protocols over wireless.

Hello all,
Are there any issues with running dynamic routing protocols through two access points (1240AG) bridging two LANs that are presumably currently setup with a dynamic routing protocol?
Thanks,
Patrick

There shouldn't be.
They are acting as bridges ... so no need for a routing protocol in the common broadcast domain.
Unless you have some flavor of broadcast / multicast control in-place, it should pass the traffic without issue.
Good Luck
Scott

Dynamic Routing Protocols - what do I really need to know?

Ok, ridiculously broad question I know but....what I'm trying to figure out is, let's say I'm in a large coproration and I have multiple field sites in different areas of the country so the network setup may be somewhat complex but when it comes to setting up the dynamic routing...is it as simple as let's say, configuring a router to use BGP for whatever portion you designate then just letting it be? is it somewhat challenging to initally configure dynamic routing protocols (i.e. how often have you found yourselves worrying about admin distance, areas (I don't even know what an "area" is yet either so if anyone could explain that I would appreciate it), etc..
So in short, are dynamic routing protocols "Set it and forget it" or do they require a ton of planning to setup? I'm familliar with the differences between them (i.e. OSPF, RIP, EIGRP,etc..) and the differences in link state and distance vector but I just wanted to ask about the setup of the protocols themselves.
Thanks!!

You can exchange routes between protocols with redistribution.
The problem with the question is, as you say, it is too broad to really answer properly.
All routing protocols have different considerations so what you might do for EIGRP you may not do with OSPF and BGP is different altogether.
As a general answer if you are enabling it across a WAN all take a certain amout of planning and design and they all rely heavily on what you have done with your IP addressing in terms of summarisation etc.
The actual configurations to get a basic setup running are relatively simple, certainly for IGPs, but as your network grows you may find the configurations becoming more complex
BGP is a very different in that there are many different commands you can use to influence the path traffic takes but even here to setup a very basic BGP peering only requires a few commands.
But no routing protocol in a large environment should just be configured with no thought as to how it is going to work, traffic paths, number of routes etc.
You can do it but you may well find as your network grows you will end up having to revisit the whole thing because it is not working as you intended.
Like I say it's too large a question to really answer because each routing protocol is different and may or may not meet the requirements of the network.
If there are more specific questions then please feel free to ask.
Jon

Which routing protocols are supported on ASA 5585

Hi,
I am curious to know which routing protocol is well supported on Cisco ASA 5585. do someone on the forum has implemented routing on ASA?
I have ASA 5585 on context mode, as of now 4 contexts have been created. upstream device is Nexus.
I have ASA with Software Version 8.4(4)1 and Device Manager Version 6.4(9).
if someone can point me to good implemented example of routing protocol to their environment (like OSPF, BGP) that would be great.
Thanks

You're welcome.
Multiple contexts adds another twist - in ASA 8.4 dynamic routing protocols are not supported at all for multiple contexts. Reference.
ASA 9.0 added support for dynamic routing protocols in multiple context modes, including OSPF v2 (but not v3 for IPv6). Reference.
FYI ASA 9.1(2) is current as of this writing and is the recommended release in the 9.x train. (Mentioned near the end of the latest TAC Security podcast - episode #37 here.)

CE dial-in to PE. What routing protocol I should use ?

Hi,
Situation - CE connected to PE via some ethernet interface (primary) and ISDN dial-up as backup, so I need to use some dynamic routing protocol to distribute customers networks to other sites. Now I'm looking towards extended (triggered) RIP, but maybe there are better choices?
As I know, only triggereg RIP and OSPF supports 'on-demand' circuits, but OSPF isn't recommended as CE-PE protocol because it has no VRF awareness and we would have to run separate OSPF process for every VRF what isn't nice. This makes RIP only choice? Or there are another possibilities, maybe BGP ?

Hi,
over all there is static, RIPv2, EIGRP, OSPF, ISIS and BGP for PE-CE.
Well floating static alone seems no possibility in your case.
RIP and EIGRP have some issues when running on redundant links into the VPN (possibility of routing loops), which would be the case with backup active and primary coming back. Depending on the exact topology there might or might not be a workaround.
OSPF has to be run as separate processes. Might be tough on PE resources, depending on your exact setup details. Other than that it does the job.
eBGP with ebgp-multihop and static routes is an option. So eBGP doesn´t go down, just is directed over backup link in case primary is down.
Pick your poison! :-)
regards
Martin

UC500 and Dynamic Routing... why not?

First off, I know that the UC500 doesn't support any dynamic routing of any kind. I'm really just here to vent. My biggest problem with this is that the entire UC line supports DMVPN, which works great, except it is somewhat useless without any routing protocol support. There is simply no reason the actual box can't support dynamic routing, in fact it actually looks like it supports RIP in a limited capacity (unoffically of course). I can receive RIP routes no problem, I just can't advertise any RIP routes.
I don't see why Cisco can't at least offer a upgrade license to enable dynamic routing.
Can someone from Cisco chime in on why this is the case? I am going to end up purchasing additional Cisco 881 routers for all my UC500 deployments simply for DMVPN and dyanmic routing. I would rather just pay for a license to enable RIP, EIGRP, OSPF, or BGP routing to be enabled on the U540...

To be honest I think the real reason they removed this from Uc5xx was they were scared some of their mid-level customers would consider ditching the more expensive enterprise kit and throwing these boxes in at their smaller site offices.
Dynamic routing is pretty useful when you get to around 10 sites, especially if your're routing voice, data and voicemail VLAN IPs through a full mesh. We've thrown in ISRs or 800 series to do this in a few cases, but we do still have static routes punched in to a few UC520s in a lot of locations.

Applying dynamic routing feature on outdoor wireless connection for load ba

Gentlemen,
Does the Cisco outdoor wireless unit support dynamic routing (e.g. RIP or others) to do the load balancing between leased line and wireless connection.
I am looking to confirm if the outdoor unit has the routing features to apply this scenario.
Thank you,

No Response !!!!
Pls your action.
Thank you,

Routing protocols over IPSEC

why can't you run a routing protocol in IPSEC tunnel mode? why do you need GRE to run a routing protocol?

Most of the dynamic routing protocols use multicast addressing or broadcast addressing for the destination address. IPSec processes unicast IP traffic. This is the reason that we have traditionally used GRE which can easily pass multicast and broadcast traffic within the tunnel as the way to run routing protocols over IPSec tunnels. With GRE the multicast routing protocol traffic is encapsulated in a GRE packet which has a unicast source and destination address.
HTH
Rick

PE-CE Dynamic routing

I am running a PE-CE vpn routing. Now my client wants to access a particulat ip which is on internet and may be the demand can be increased and he doesnot want to add the addtional static routes for this. Can we have any routing solution which can solve the purpose. Please post your comments.
regards
shivlu

Hi Shivlu,
What i understand is, This is an VPN customer and you running dynamic routing protocol (RIPv2/OSPF/EIGRP/BGP) as PE-CE, the customer want to access specific destination address on the internet (google.com) for example, so now we talking about how to make this route reachable through the customer VPN, i think Route Leaking in MPLS/VPN will solve your issue, but in this case you should consider the customer address space issue, i mean how the customer private routes will talk to internet destination, there is a NAT device should be in the path to NAT the customer private address.
This is a very simple URL by Cisco explaning MPLS Route Leaking:
http://www.cisco.com/en/US/tech/tk436/tk832/technologies_configuration_example09186a0080231a3e.shtml
In this case you will add 2 static routes on your PE and redistribute it by the customer PE-CE routing protocol.
Correct me if i didn't get your point
Best Regards,
Mounir Mohamed

Dell Sonicwall Dynamic Routing Device Support

Up until November 24, 2014 the known compatible VPN devices here
http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx listed Dell Sonicwall as compatible. The page was updated November 24, and Dell Sonicwall is now listed as Not Compatible.
Can someone please explain what changed, and why Sonicwall is no longer compatible?

Hi All,
The Device has been removed from the compatibility list for Dynamic Configuration after repeated complaints from customers about intermittent performance.
On analysis it was gathered that the device works in a dynamic (route-based) mode only when SonicWall VPN initiates the IPSEC negotiations.
When Azure Gateway initiates the IPSEC negotiations, it fails.
Also DELL's official Website states Route-Based VPN using Tunnel Interface is not supported for third party devices.
For details you could refer the following link.
https://support.software.dell.com/kb/sw7902
If you still need assistance with the device, you might have to get in touch with DELL Support.
Regards,
Malar.

Is there a way to upgrade a Cisco 866VAE router to support the OSPF routing protocol?

I work for the government and we purchased a Cisco 866 VAE router for a project. Our base network runs OSPF routing protocol and we need to know if there is a way to upgrade the router that we purchased to support this protocol.
Thanks for any assistance,
James Reynolds

Hi,
I have searched through both the data sheet and the 800 series config guides and
it looks like there is NO support for OSPF for this router family.
http://www.cisco.com/c/en/us/products/collateral/routers/800-series-routers/data_sheet_c78-693249.html
http://www.cisco.com/c/en/us/td/docs/routers/access/800/software/configuration/guide/SCG800Guide.pdf
Regards
Alex

IPSEC tunnel and Routing protocols Support

Hi Everyone,
I read IPSEC does not support Routing Protocols with Site to Site VPN as they both are Layer4.
Does it mean that If Site A has to reach Site B over WAN link we should use Static IP on Site A and Site B Router?
In my home Lab i config Site to Site IPSES VPN and they are working fine using OSPF does this mean that IPSEC supports Routing Protocol?
IF someone can explain me this please?
OSPF config A side
router ospf 1
router-id 3.4.4.4
log-adjacency-changes
area 10 virtual-link 10.4.4.1
passive-interface Vlan10
passive-interface Vlan20
network 3.4.4.4 0.0.0.0 area 0
network 192.168.4.0 0.0.0.255 area 10
network 192.168.5.0 0.0.0.255 area 0
network 192.168.10.0 0.0.0.255 area 0
network 192.168.20.0 0.0.0.255 area 0
network 192.168.30.0 0.0.0.255 area 0
network 192.168.98.0 0.0.0.255 area 0
network 192.168.99.0 0.0.0.255 area 0
3550SMIA#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.5.3 to network 0.0.0.0
O    192.168.12.0/24 [110/13] via 192.168.5.3, 3d17h, FastEthernet0/11
     100.0.0.0/32 is subnetted, 1 subnets
O       100.100.100.100 [110/3] via 192.168.5.3, 3d17h, FastEthernet0/11
     3.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
O       3.3.3.3/32 [110/2] via 192.168.5.3, 3d17h, FastEthernet0/11
C       3.4.4.0/24 is directly connected, Loopback0
C    192.168.30.0/24 is directly connected, Vlan30
     64.0.0.0/32 is subnetted, 1 subnets
O E2    64.59.135.150 [110/300] via 192.168.5.3, 1d09h, FastEthernet0/11
     4.0.0.0/32 is subnetted, 1 subnets
O       4.4.4.4 [110/2] via 192.168.5.3, 3d17h, FastEthernet0/11
C    192.168.10.0/24 is directly connected, Vlan10
     172.31.0.0/24 is subnetted, 4 subnets
O E2    172.31.3.0 [110/300] via 192.168.5.3, 3d17h, FastEthernet0/11
O E2    172.31.2.0 [110/300] via 192.168.5.3, 3d17h, FastEthernet0/11
O E2    172.31.1.0 [110/300] via 192.168.5.3, 3d17h, FastEthernet0/11
O E2    172.31.0.0 [110/300] via 192.168.5.3, 3d17h, FastEthernet0/11
O    192.168.11.0/24 [110/3] via 192.168.5.3, 3d17h, FastEthernet0/11
O    192.168.98.0/24 [110/2] via 192.168.99.1, 3d17h, FastEthernet0/8
C    192.168.99.0/24 is directly connected, FastEthernet0/8
C    192.168.20.0/24 is directly connected, Vlan20
     192.168.5.0/31 is subnetted, 1 subnets
C       192.168.5.2 is directly connected, FastEthernet0/11
C    10.0.0.0/8 is directly connected, Tunnel0
     192.168.6.0/31 is subnetted, 1 subnets
O       192.168.6.2 [110/2] via 192.168.5.3, 3d17h, FastEthernet0/11
O    192.168.1.0/24 [110/13] via 192.168.5.3, 3d17h, FastEthernet0/11
O*E2 0.0.0.0/0 [110/1] via 192.168.5.3, 1d09h, FastEthernet0/11
B Side Config
Side A
router ospf 1
log-adjacency-changes
network 192.168.97.0 0.0.0.255 area 0
network 192.168.98.0 0.0.0.255 area 0
network 192.168.99.0 0.0.0.255 area 0
1811w# sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is 192.168.99.2 to network 0.0.0.0
O    192.168.12.0/24 [110/14] via 192.168.99.2, 3d17h, FastEthernet0
     100.0.0.0/32 is subnetted, 1 subnets
O       100.100.100.100 [110/4] via 192.168.99.2, 3d17h, FastEthernet0
     3.0.0.0/32 is subnetted, 2 subnets
O       3.3.3.3 [110/3] via 192.168.99.2, 3d17h, FastEthernet0
O       3.4.4.4 [110/2] via 192.168.99.2, 3d17h, FastEthernet0
O    192.168.30.0/24 [110/2] via 192.168.99.2, 3d17h, FastEthernet0
     64.0.0.0/32 is subnetted, 1 subnets
O E2    64.59.135.150 [110/300] via 192.168.99.2, 1d09h, FastEthernet0
     4.0.0.0/32 is subnetted, 1 subnets
O       4.4.4.4 [110/3] via 192.168.99.2, 3d17h, FastEthernet0
O    192.168.10.0/24 [110/2] via 192.168.99.2, 3d17h, FastEthernet0
     172.31.0.0/24 is subnetted, 4 subnets
O E2    172.31.3.0 [110/300] via 192.168.99.2, 3d17h, FastEthernet0
O E2    172.31.2.0 [110/300] via 192.168.99.2, 3d17h, FastEthernet0
O E2    172.31.1.0 [110/300] via 192.168.99.2, 3d17h, FastEthernet0
O E2    172.31.0.0 [110/300] via 192.168.99.2, 3d17h, FastEthernet0
O    192.168.11.0/24 [110/4] via 192.168.99.2, 3d17h, FastEthernet0
C    192.168.98.0/24 is directly connected, BVI98
C    192.168.99.0/24 is directly connected, FastEthernet0
O    192.168.20.0/24 [110/2] via 192.168.99.2, 3d17h, FastEthernet0
     192.168.5.0/31 is subnetted, 1 subnets
O       192.168.5.2 [110/2] via 192.168.99.2, 3d17h, FastEthernet0
     192.168.6.0/31 is subnetted, 1 subnets
O       192.168.6.2 [110/3] via 192.168.99.2, 3d17h, FastEthernet0
O    192.168.1.0/24 [110/14] via 192.168.99.2, 3d17h, FastEthernet0
O*E2 0.0.0.0/0 [110/1] via 192.168.99.2, 1d09h, FastEthernet0
Thanks
Mahesh

Hello,
I'm saying crypto maps have a lot of limitations. Tunnel Protection make way more sense
U can configure in 2 ways [ and multicast WILL work over it]
1- GRE over IPSEC
crypto ipsec transform-set aes esp-aes 256 esp-sha-hmac
mode transport
crypto ipsec profile tp
set transform-set aes
int tu1
ip address 255.255.255.252
tunnel source
tunnel destination
tunne protection ipsec profile tp
We have configured mode transport because we encrypt GRE + what ever we encapsule in GRE [ eg OSPF - telnet - http ]
Pros:
We can as well transport IPV6 or CDP
Cons:
4 bytes of overhead due to GRE
2- IP over IPSEC
crypto ipsec transform-set aes esp-aes 256 esp-sha-hmac
mode tunnel
crypto ipsec profile tp
set transform-set aes
int tu1
ip address 255.255.255.252
tunnel source
tunnel destination
tunnel mode ipsec ipv4
tunne protection ipsec profile tp
This config is in fact closer from a crypto map [ from encapsulation standpoint]. The transform-set then NEED to be in tunnel-mode
Pro:
4 bytes overhead less than GRE over IPSEC
Cons:
Cannot transport CDP or MPLS or IPV6. Very limiting IMHO
Cheers
Olivier

Dynamic Trunking Protocol and ports mode

((Dynamic Trunking Protocol (DTP), as the name implies, is the protocol used to automatically negotiate a trunk link.
DTP supports the auto negotiation of both ISL and 802.1q.
By default all ports on the Catalyst 3550 are dynamic desirable ports which will aggressively attempt to negotiate trunking through DTP.
To disable DTP and the auto negotiation of trunking, issue the interface level command switchport
nonegotiate)).
1- How many trunk mode have we got ? one of them is negotiation,,,Do we have any other ?
2- "By default all ports on the Catalyst 3550 are dynamic desirable ports".
2/a- Are there any other mode for ports ?
2/b- Is this different form one type of switch to another type ?

"1.Diff trunk modes are on,off,desirable,negotiate".
Does DTP decide which mode to be used (chose one out of 5)?
"2/a. Diff modes of ports are, access, trunk, dynamic desirable. "
does that mean the dynamic desirable can be either access or trunk port ?
I get confused between three different interface mode :
1- switchports----can be access and trunk ports
2- routed ports
3- switched-virtual interface

If support dynamic routing protocol?

Similar Messages

Maybe you are looking for