Configure DVTI with Dynamic Routing Protocols on Secure Firewall

Available Languages

Download Options

PDF (100.1 KB)
View with Adobe Reader on a variety of devices
ePub (132.2 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (117.1 KB)
View on Kindle device or Kindle app on multiple devices

Updated:March 30, 2023

Document ID:220320

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Background Information

Dynamic Virtual Tunnel Interfaces

Introduction

This document describes how to configure a Dynamic Virtual Tunnel Interface (DVTI) on Secure Firewall 9.20.

Prerequisites

Have one Cisco Secure Firewall with ASA 9.20 or later with a basic routing configuration and IKEV2 support that works as the hub with one Loopback interface to simulate local network on premises of 192.168.9.0/24.
Have one Cisco Secure Firewall with ASA 9.20 or later with basic routing configuration and IKEv2 support to work as a spoke-1 with one Loopback interface preconfigured to simulate remote network of 192.168.7.0/24.

Requirements

General knowledge of all dynamic routing protocols described on this document (OSPF, EIGRP and BGP).
Be familiar with CLI configuration on Cisco Secure Firewall devices.

Components Used

The information in this document is based on these software versions:

Cisco Secure Firewall with ASA 9.20 or later.

Note: The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Dynamic Virtual Tunnel Interfaces

Dynamic Virtual Tunnel Interfaces (DVTI) can provide highly secure and scalable connectivity for remote-access Virtual Private Networks (VPN).

DVTIs can be used for both Hub and Spoke configuration. The tunnels provide an on-demand separate virtual access interface for each VPN session.

1. The spoke initiates an IKE exchange request with the hub for a VPN connection.

2. The hub authenticates the spoke.

3. The Cisco Secure Firewall Management Centerassigns a dynamic virtual template on the hub.

4. The virtual template dynamically generates a virtual access interface on the hub. This interface is unique for the VPN session per spoke.

5. The hub establishes a dynamic VTI tunnel with the spoke that uses the virtual access interface.

6. The hub and spoke exchange traffic over the tunnel that uses dynamic routing protocols (BGP/OSPF/EIGRP) or with protected networks feature (Multiple-Security Association VTI).

7. Dynamic VTIs function like any other interface so that you can apply QoS, firewall rules, routing protocols and other features as soon as the tunnel is active.

8. A single DVTI is created at the HUB device and multiple Static Tunnel Interfaces for multiple remote/spoke sites.

In this article BGP, OSPF and EIGRP can be tested over DVTI.

Note: Cisco Secure Firewall added support fot DVTI on version 7.3 and currently it only supports one single DVTI as per Cisco bug ID CSCwe13781.

Configure

Network Diagram

Topology

Configurations

Cisco Secure Firewall Hub configuration

Configure physical tunnel source interface.

interface GigabitEthernet0/0
 nameif vlan2820
 security-level 100
 ip address 10.28.20.98 255.255.255.0

Configure IkEv2 policy.

crypto ikev2 policy 1
 encryption aes-256 aes-192 aes
 integrity sha512 sha384 sha256 sha
 group 21 20 14
 prf sha256
 lifetime seconds 86400

Configure IPSEC policy and attach it to a new IPSEC profile.

crypto ipsec ikev2 ipsec-proposal VPN-LAB
 protocol esp encryption aes-256 aes-192 aes
 protocol esp integrity sha-512 sha-256 sha-1

crypto ipsec profile VPN-LAB-PROFILE
 set ikev2 ipsec-proposal VPN-LAB
 set security-association lifetime seconds 1000

Configure Virtual-template with with the IPSEC Profile previously created and assign it to a Loopback interface that provides the IP Address for the DVTI.

Note: Virtual-template is used to configure DVTI for on-demand tunnels.

interface Loopback200
 nameif DVTI-LOOPBACK
 ip address 172.16.17.1 255.255.255.255 

interface Virtual-Template1 type tunnel
 nameif DVTI-HUB
 ip unnumbered DVTI-LOOPBACK
 tunnel source interface vlan2820
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile FMC_IPSEC_PROFILE_2

Create a secondary Loopback interface to simulate traffic from OnPREM network behind hub.

Note: Skip this step if you have local traffic behind the hub.

interface Loopback100
 nameif ON-PREM
 ip address 192.168.9.1 255.255.255.255

Configure tunnel-group.

Note: The command route set interface sends the DVTI IP address as a static IP address to the peer.

tunnel-group 10.28.20.100 type ipsec-l2l
tunnel-group 10.28.20.100 ipsec-attributes
 virtual-template 1 
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
 ikev2 route set interface

Enable IKEv2 on the interface that builds the tunnel.

crypto ikev2 enable vlan2820

Cisco Secure Firewall spoke configuration

Configure physical tunnel source interface.

interface GigabitEthernet0/0
 nameif vlan2820
 security-level 100
 ip address 10.28.20.100 255.255.255.0

Configure IKEv2 policy.

crypto ikev2 policy 1
 encryption aes-256 aes-192 aes
 integrity sha512 sha384 sha256 sha
 group 21 20 14
 prf sha256
 lifetime seconds 86400

Configure IPSEC policy and attach it to a new IPSEC profile.

crypto ipsec ikev2 ipsec-proposal VPN-LAB
 protocol esp encryption aes-256 aes-192 aes
 protocol esp integrity sha-512 sha-256 sha-1
crypto ipsec profile VPN-LAB-PROFILE
 set ikev2 ipsec-proposal VPN-LAB
 set security-association lifetime seconds 1000

Configure Static Virtual Tunnel Interface with the IPSEC Profile, previously created and assign it to a Loopback interface that provides the unnumbered IP Address.

interface Loopback200
 nameif VTI-LOOPBACK
 ip address 172.16.17.2 255.255.255.255 

interface Tunnel2
 nameif SVTI-SPOKE-3
 ip unnumbered VTI-LOOPBACK
 tunnel source interface vlan2820
 tunnel destination 10.28.20.98
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile VPN-LAB-PROFILE

Create a secondary Loopback interface to simulate traffic from LAN-REMOTE-1 network behind spoke.

interface Loopback100
 nameif LAN-REMOTE-1
 ip address 192.168.7.1 255.255.255.255

Configure tunnel-group.

Note: The command route set interface sends the SVTI IP address as a static IP address to the peer.

tunnel-group 10.28.20.98 type ipsec-l2l
tunnel-group 10.28.20.98 ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
 ikev2 route set interface

Enable IKEv2 on the interface that can build the tunnel.

crypto ikev2 enable vlan2820

Configure OSPF

Hub configuration

Note: Redistribute connected subnets command is used to advertise OnPREM network to the spokes via OSPF. Redistribution can be different as per design.

router ospf 1
 router-id 172.16.17.1
 network 172.16.17.0 255.255.255.0 area 0
 log-adj-changes
 redistribute connected subnets

Spoke configuration

router ospf 1
 router-id 172.16.17.2
 network 172.16.17.0 255.255.255.0 area 0
 log-adj-changes
 redistribute connected subnets

Verify OSPF

Hub verification

ASAV2-hub# show ospf 

 Routing Process "ospf 1" with ID 172.16.17.1
 Start time: 4d23h, Time elapsed: 3d04h
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 It is an autonomous system boundary router
 Redistributing External Routes from,
    connected, includes subnets in redistribution
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 5000 msecs
 Minimum hold time between two consecutive SPFs 10000 msecs
 Maximum wait time between two consecutive SPFs 10000 msecs
 Incremental-SPF disabled
 Minimum LSA interval 5 secs
 Minimum LSA arrival 1000 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 Number of external LSA 5. Checksum Sum 0x39716 
 Number of opaque AS LSA 0. Checksum Sum 0x0     
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0)
        Number of interfaces in this area is 3 (1 loopback)
        Area has no authentication
        SPF algorithm last executed 2d04h ago
        SPF algorithm executed 10 times
        Area ranges are
        Number of LSA 2. Checksum Sum 0x1c99f 
        Number of opaque link LSA 0. Checksum Sum 0x0     
        Number of DCbitless LSA 0
        Number of indication LSA 0
        Number of DoNotAge LSA 0
        Flood list length 0

ASAV2-hub# show ospf neighbor 
Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.17.2       0   FULL/  -        0:00:39     172.16.17.2     DVTI-HUB_va11

Routing table on hub now shows LAN-REMOTE-1 network via OSPF.

ASAV2-hub# show route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

O E2     192.168.7.0 255.255.255.255
           [110/20] via 172.16.17.2, 2d04h, DVTI-HUB_va11

Spoke verification

ASAv-spoke-2# show ospf 

 Routing Process "ospf 1" with ID 172.16.17.2
 Start time: 3w3d, Time elapsed: 3d04h
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 It is an autonomous system boundary router
 Redistributing External Routes from,
    connected, includes subnets in redistribution
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 5000 msecs
 Minimum hold time between two consecutive SPFs 10000 msecs
 Maximum wait time between two consecutive SPFs 10000 msecs
 Incremental-SPF disabled
 Minimum LSA interval 5 secs
 Minimum LSA arrival 1000 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 Number of external LSA 4. Checksum Sum 0x37bc8 
 Number of opaque AS LSA 0. Checksum Sum 0x0     
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0)
        Number of interfaces in this area is 2 (1 loopback)
        Area has no authentication
        SPF algorithm last executed 2d04h ago
        SPF algorithm executed 1 times
        Area ranges are
        Number of LSA 2. Checksum Sum 0x1fe9a 
        Number of opaque link LSA 0. Checksum Sum 0x0     
        Number of DCbitless LSA 0
        Number of indication LSA 0
        Number of DoNotAge LSA 0
        Flood list length 0

ASAv-spoke-2#  show ospf neighbor 
Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.17.1       0   FULL/  -        0:00:34     172.16.17.1     SVTI-SPOKE-3

Routing table on spoke now shows OnPREM network via OSPF.

ASAv-spoke-2# show route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

O E2     192.168.9.1 255.255.255.255 
           [110/20] via 172.16.17.1, 2d04h, SVTI-SPOKE-3

Now spoke LAN-REMOTE-1 is able to reach OnPREM.

ASAv-spoke-2# ping LAN-REMOTE-1 192.168.9.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.9.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

ASAv-spoke-2# show crypto ipsec sa peer  10.28.20.98 | i cap|iden|spi
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      #pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
      #pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      current outbound spi: 4BC1FF2C
      current inbound spi : FB455CB8
      spi: 0xFB455CB8 (4215626936)
      spi: 0x4BC1FF2C (1271004972)

Now hub OnPREM is able to reach LAN-REMOTE-1.

ASAV2-hub# ping ON-PREM  192.168.7.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

ASAV2-hub# show crypto ipsec sa peer 10.28.20.100
peer address: 10.28.20.100
interface: DVTI-HUB_va12
    Crypto map tag: DVTI-HUB_vtemplate_dyn_map, seq num: 1, local addr: 10.28.20.98

      Protected vrf (ivrf): Global
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      current_peer: 10.28.20.100


      #pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15
      #pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 15, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 10.28.20.98/500, remote crypto endpt.: 10.28.20.100/500
      path mtu 1500, ipsec overhead 94(44), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled

Configure EIGRP

Hub configuration:

ASAV2-hub# sh run router
router eigrp 10
 network 172.16.17.0 255.255.255.0
 redistribute connected

Spoke configuration:

ASAv-spoke-2# sh run router
router eigrp 10
 network 172.16.17.0 255.255.255.0
 redistribute connected

Now spoke LAN-REMOTE-1 is able to reach OnPREM.

ASAv-spoke-2# ping LAN-REMOTE-1 192.168.9.1 rep 100                  
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.9.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/10 ms

ASAv-spoke-2# show crypto ipsec sa peer 10.28.20.98  | i cap|iden|spi
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      #pkts encaps: 102, #pkts encrypt: 102, #pkts digest: 102
      #pkts decaps: 102, #pkts decrypt: 102, #pkts verify: 102
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      current outbound spi: 3EED404C
      current inbound spi : 646D2C0C
      spi: 0x646D2C0C (1684876300)
      spi: 0x3EED404C (1055735884)

Now hub OnPREM is able to reach LAN-REMOTE-1.

ASAV2-hub# ping ON-PREM 192.168.7.1 rep 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.7.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/1/10 ms

ASAV2-hub# show crypto ipsec sa peer 10.28.20.100 | i cap|iden|spi
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      #pkts encaps: 208, #pkts encrypt: 208, #pkts digest: 208
      #pkts decaps: 208, #pkts decrypt: 208, #pkts verify: 208
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      current outbound spi: 646D2C0C
      current inbound spi : 3EED404C
      spi: 0x3EED404C (1055735884)
      spi: 0x646D2C0C (1684876300)

Verify EIGRP

Hub verification:

ASAV2-hub# show eigrp neighbors 
EIGRP-IPv4 Neighbors for AS(10)
H   Address                 Interface       Hold Uptime   SRTT   RTO   Q  Seq
                                            (sec)         (ms)        Cnt Num
0   172.16.17.2             DVTI-HUB_va12    12  00:02:01 8      200  0     4

Routing table on hub now shows LAN-REMOTE-1 network via EIGRP.

ASAV2-hub# show route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

D EX     192.168.7.1 255.255.255.255 
           [170/53760] via 172.16.17.2, 00:05:28, DVTI-HUB_va12

Spoke verification:

ASAv-spoke-2# show eigrp neighbors 
EIGRP-IPv4 Neighbors for AS(10)
H   Address                 Interface       Hold Uptime   SRTT   RTO   Q  Seq
                                            (sec)         (ms)        Cnt Num
0   172.16.17.1             SVTI-SPOKE-3     12  00:07:05 34     204  0     3

Routing table on spoke now shows OnPREM network via EIGRP.

ASAv-spoke-2# show route eigrp 

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

D EX     192.168.9.1 255.255.255.255 
           [170/53760] via 172.16.17.1, 00:07:43, SVTI-SPOKE-3

Configure BGP

Note: When static or dynamic VTI interfaces are combined with eBGP, ensure that the value of the TTL hop is more than one if you use BGP.

Hub configuration:

router bgp 100
 bgp log-neighbor-changes
 bgp bestpath compare-routerid
 address-family ipv4 unicast
  neighbor 172.16.17.2 remote-as 200
  neighbor 172.16.17.2 ebgp-multihop 10
  neighbor 172.16.17.2 activate
  redistribute connected
  no auto-summary
  no synchronization
 exit-address-family

Spoke configuration

router bgp 200
 bgp log-neighbor-changes
 bgp bestpath compare-routerid
 address-family ipv4 unicast
  neighbor 172.16.17.1 remote-as 100
  neighbor 172.16.17.1 ebgp-multihop 10
  neighbor 172.16.17.1 activate
  redistribute connected
  no auto-summary
  no synchronization
 exit-address-family

Verify BGP

Hub verification:

ASAV2-hub# show bgp neighbors 

BGP neighbor is 172.16.17.2,  context single_vf,  remote AS 200, external link
  BGP version 4, remote router ID 192.168.7.1
  BGP state = Established, up for 00:05:28
  Last read 00:00:01, last write 00:01:00, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable (disabled)
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
    Multisession Capability: 
  Message statistics:
    InQ depth is 0
    OutQ depth is 0
    
                   Sent       Rcvd
    Opens:         1          1         
    Notifications: 0          0         
    Updates:       2          2         
    Keepalives:    6          6         
    Route Refresh: 0          0         
    Total:         9          9         
  Default minimum time between advertisement runs is 30 seconds
              
 For address family: IPv4 Unicast
  Session: 172.16.17.2
  BGP table version 7, neighbor version 7/0
  Output queue size : 0
  Index 1
  1 update-group member
                           Sent       Rcvd
  Prefix activity:         ----       ----
    Prefixes Current:      3          3          (Consumes 240 bytes)
    Prefixes Total:        3          3         
    Implicit Withdraw:     0          0         
    Explicit Withdraw:     0          0         
    Used as bestpath:      n/a        2         
    Used as multipath:     n/a        0         

                                Outbound    Inbound
  Local Policy Denied Prefixes: --------    -------
    Bestpath from this peer:     2          n/a       
    Total:                       2          0         
  Number of NLRIs in the update sent: max 3, min 0

  Address tracking is enabled, the RIB does have a route to 172.16.17.2
  Connections established 1; dropped 0
  Last reset never
  External BGP neighbor may be up to 10 hops away.
  Transport(tcp) path-mtu-discovery is enabled
  Graceful-Restart is disabled

ASAV2-hub#  
ASAV2-hub#  sh run router
router bgp 100
 bgp log-neighbor-changes
 bgp bestpath compare-routerid
 address-family ipv4 unicast
  neighbor 172.16.17.2 remote-as 200
  neighbor 172.16.17.2 ebgp-multihop 10
  neighbor 172.16.17.2 activate
  redistribute connected
  no auto-summary
  no synchronization
 exit-address-family
!
ASAV2-hub# sh run all router
router bgp 100
 bgp log-neighbor-changes
 no bgp always-compare-med
 no bgp asnotation dot
 no bgp bestpath med
 bgp bestpath compare-routerid
 bgp default local-preference 100
 no bgp deterministic-med
 bgp enforce-first-as
 bgp maxas-limit 0
 bgp transport path-mtu-discovery
 timers bgp 60 180 0
 address-family ipv4 unicast
  bgp scan-time 60
  bgp nexthop trigger enable
  bgp nexthop trigger delay 5
  bgp aggregate-timer 30
  neighbor 172.16.17.2 remote-as 200
  neighbor 172.16.17.2 ebgp-multihop 10
  neighbor 172.16.17.2 activate
  no bgp redistribute-internal
  no bgp soft-reconfig-backup
  no bgp suppress-inactive
  redistribute connected
  distance bgp 20 200 200
  no auto-summary
  no synchronization
 exit-address-family
!

Routing table on hub now shows LAN-REMOTE-1 network via BGP.

ASAV2-hub# show route bgp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

B        192.168.7.1 255.255.255.255 [20/0] via 172.16.17.2, 00:06:16

Spoke verification:

ASAv-spoke-2# show bgp neighbors 

BGP neighbor is 172.16.17.1,  context single_vf,  remote AS 100, external link
  BGP version 4, remote router ID 192.168.9.1
  BGP state = Established, up for 00:06:59
  Last read 00:00:27, last write 00:00:20, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable (disabled)
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
    Multisession Capability: 
  Message statistics:
    InQ depth is 0
    OutQ depth is 0
    
                   Sent       Rcvd
    Opens:         1          1         
    Notifications: 0          0         
    Updates:       2          2         
    Keepalives:    7          8         
    Route Refresh: 0          0         
    Total:         10         11        
  Default minimum time between advertisement runs is 30 seconds
              
 For address family: IPv4 Unicast
  Session: 172.16.17.1
  BGP table version 9, neighbor version 9/0
  Output queue size : 0
  Index 1
  1 update-group member
                           Sent       Rcvd
  Prefix activity:         ----       ----
    Prefixes Current:      3          3          (Consumes 240 bytes)
    Prefixes Total:        3          3         
    Implicit Withdraw:     0          0         
    Explicit Withdraw:     0          0         
    Used as bestpath:      n/a        2         
    Used as multipath:     n/a        0         

                                Outbound    Inbound
  Local Policy Denied Prefixes: --------    -------
    Bestpath from this peer:     3          n/a       
    Total:                       3          0         
  Number of NLRIs in the update sent: max 3, min 0

  Address tracking is enabled, the RIB does have a route to 172.16.17.1
  Connections established 1; dropped 0
  Last reset never
  External BGP neighbor may be up to 10 hops away.
  Transport(tcp) path-mtu-discovery is enabled
  Graceful-Restart is disabled

Routing table on spoke now shows OnPREM network via BGP.

ASAv-spoke-2#   show route bgp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

B        192.168.9.1 255.255.255.255 [20/0] via 172.16.17.1, 00:09:22

Troubleshoot

To troubleshoot OSPF, use these debugs and show commands:

  debug ip ospf 
  debug ip ospf packet 
  debug ip ospf events 
  debug ip ospf hello 
  debug ip ospf adj 

  show ospf 
  show ospf neighbor 
  show ospf interface

To troubleshoot EIGRP, use these debugs and show commands:

  debug ip eigrp 
  debug ip eigrp neighbor 
  debug ip eigrp notifications 
    
  show eigrp 
  show eigrp <AS>
  show eigrp interfaces 
  show eigrp neighbors 
  show eigrp topology

To troubleshoot BGP, use these debugs and show commands:.

  debug ip bgp all 
  debug ip bgp updates 
  debug ip bgp events 
  
  show bgp 
  show bgp summary 
  show bgp neighbors

To troubleshoot IKEv2, use these debugs and show commands:

  debug crypto ikev2 protocol 255
  debug crypto ikev2 platform 255
  debug crypto ipsec 255

Related Information

Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
1.0	31-Mar-2023	Initial Release

Contributed by Cisco Engineers

Alan Omar Garcia Marchan
Cisco HTTS Engineer

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

This Document Applies to These Products

Secure Firewall ASA

Configure DVTI with Dynamic Routing Protocols on Secure Firewall

Available Languages

Download Options

Bias-Free Language

Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Dynamic Virtual Tunnel Interfaces

Configure

Network Diagram

Configurations

Configure OSPF

Verify OSPF

Configure EIGRP

Verify EIGRP

Configure BGP

Verify BGP

Troubleshoot

Related Information

Revision History

Contributed by Cisco Engineers

Was this Document Helpful?

Contact Cisco

This Document Applies to These Products