The cisco ASA has the means for route installation upon establishments of a active vpn-tunnel. This is accomplished via the set reverse-route command within our crypto map. This is similar to the cisco legacy vpn concentrator and the Reverse Route Injector.
1st let's look at our topology and the route table & then we will look at the configurations and controls for route-injecting.
ASA crypto map
crypto map EXTERNAL02_map0 10 match address VPN2FGTHQ
crypto map EXTERNAL02_map0 10 set peer 220.127.116.11
crypto map EXTERNAL02_map0 10 set ikev1 transform-set ESP-AES-128-SHA
crypto map EXTERNAL02_map0 10 set reverse-route #<-we add the route injection-command
crypto map EXTERNAL02_map0 interface EXTERNAL02
note: The command set reverse-route will install the vpn remote-destination into the local route-table
Now in order to push this route into our DYNAMIC routing protocol ( OSPF ), we will perform some redistribution and controls for this process.
1st let's build a prefix-list matching only our remote vpn prefixes;
prefix-list myvpnroutes description USE THIS RT-map for controlling insertion of our vpn routes
prefix-list myvpnroutes seq 5 permit 192.168.254.0/24
Next, we will build a route-map that calls up our prefix-list. This route-map will be used in our ospf process and for controlling routes that we populate into ospf.
route-map myvpn_learned_routes permit 10
match ip address prefix-list myvpnroutes
set metric 12000
set metric-type type-1
route-map myvpn_learned_routes deny 100
and within our ospf process;
router ospf 1
network 10.200.21.0 255.255.255.0 area 0
redistribute static subnets tag 700 route-map myvpn_learned_routes #---our-route-map
default-information originate metric 1000 metric-type 1
Now within our routing domain, we will have the vpn injected route, we will check on our core-L3 switch;
The 192.168.254.0/24 prefix is now installed into OSPF via the redistribution process on our cisco ASA.
We can also check our ospf-database for confirmation;
Freelance Network & Security Engineer
kfelix -a--t- socpuppets ---d--o--t--- com
=( * * )=