[c-nsp] ASA / EIGRP / Redundant Interfaces

[Jason Link]

Unfortunately, EIGRP on the ASA doesn't appear to support the max-paths
command.

Both physical interfaces are in the same VLAN, connected to different
switches that are trunked together...and I understand that only one
switchport "should" be active, and it is shown as such when doing a "sh
int redun1 detail", but it appears to be learning (and using) routes
from both routers that are on the VLAN.

Additionally, I'm not sure HSRP would help me in a situation like this,
since the way I understand it the ASA will still learn both routers
"real" IP address and will form a neighbor to each one.  I would like to
avoid calling out the neighbor specifically, if I can help it.

Maybe I could play around with the RSTP priority on the particular
switch uplink ports to make it so that one of the ports is blocking -
that way if a switch dies, that port will stop blocking and then
converge.  It may take a little longer, but I believe the end result
would be the same...but I'm not sure this is any better than calling out
the neighbor specifically (the HSRP address).




-----Original Message-----
From: Peter Rathlev [mailto:peter at rathlev.dk] 
Sent: Thursday, April 30, 2009 2:23 AM
To: Jason Link
Cc: Cisco-nsp
Subject: Re: [c-nsp] ASA / EIGRP / Redundant Interfaces

On Wed, 2009-04-29 at 14:57 -0500, Jason Link wrote:
> With an ASA running a redundant physical interface pair for the Inside
> interface, each link connected to a separate switch which is connected
> to a separate router, and everything running EIGRP, I get multiple
> routes (2) to the same destination subnet, one for each of the
connected
> routers.  This is obviously causing problems, and I can't seem to find
a
> way to resolve it.  Setting delay on the physical interfaces doesn't
> seem to take effect, and there is no variance sub-command so I can't
> just force one route.  This needs to function in a redundant
situation,
> as in if I lose a router or switch everything will continue to
function
> (hence the redundant interface).  I tried google and cisco and found
> nothing of any significance...anyone got any ideas?

AFAIK the "standard" way of doing this would be a shared VLAN on the
inside and then HSRP or similar on the routers. Any reason for not doing
that?

Regards,
Peter