Configuring EIGRP on Cisco ASA: A Quick Lab Guide
Setting up EIGRP on a Cisco Adaptive Security Appliance (ASA) is a bit different from doing it on a standard Cisco IOS router. Because security appliances handle traffic with strict firewall rules and security contexts, you need to pay close attention to interfaces, security levels, and passive interfaces.
Here is a straightforward, step-by-step guide to get your ASA EIGRP lab up and running smoothly.
Let's see the configuration:-
Goal:-
- Configure the topology as per the diagram
- Configure the IP addresses as per the topology
- Configure ZONES on the ASA firewall
- Configure EIGRP routing on routers and ASA
- Verify with show commands
R1(config)#interface fastethernet 0/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0
R1(config-if)#no shutdown
R1(config-if)#exit
R1(config)#interface loopback 0
R1(config-if)#ip address 10.1.1.1 255.0.0.0
R1(config-if)#exit
R2(config)#interface fastethernet 0/0
R2(config-if)#ip address 192.168.2.1 255.255.255.0
R2(config-if)#no shutdown
R2(config-if)#exit
R2(config)#interface loopback 0
R2(config-if)#ip address 20.1.1.1 255.0.0.0
R2(config-if)#exit
R3(config)#interface fastethernet 0/0
R3(config-if)#ip address 192.168.3.1 255.255.255.0
R3(config-if)#no shutdown
R3(config-if)#exit
R3(config)#interface loopback 0
R3(config-if)#ip address 30.1.1.1 255.0.0.0
R3(config-if)#exit
R1(config)#router eigrp 100
R1(config-router)#network 192.168.1.0
R1(config-router)#network 10.0.0.0
R1(config-router)#exit
%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.1.2 (FastEthernet0/0) is up: new adjacency
R2(config)#router eigrp 100
R2(config-router)#network 192.168.2.0
R2(config-router)#network 20.0.0.0
R2(config-router)#exit
%DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.2.2 (FastEthernet0/0) is up: new adjacency
R3(config)#router eigrp 100
R3(config-router)#network 192.168.3.0
R3(config-router)#network 30.0.0.0
R3(config-router)#exit
DUAL-5-NBRCHANGE: EIGRP-IPv4 100: Neighbor 192.168.3.2 (FastEthernet0/0) is up: new adjacency
ciscoasa(config)# interface gig 1
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 192.168.1.2 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# interface gig 2
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# ip address 192.168.2.2 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# interface gig 3
ciscoasa(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by default.
ciscoasa(config-if)# security-level 50
ciscoasa(config-if)# ip address 192.168.3.2 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# show ip
System IP Addresses:
Interface Name IP address Subnet mask Method
GigabitEthernet1 inside 192.168.1.2 255.255.255.0 manual
GigabitEthernet2 outside 192.168.2.2 255.255.255.0 manual
GigabitEthernet3 dmz 192.168.3.2 255.255.255.0 manual
Current IP Addresses:
Interface Name IP address Subnet mask Method
GigabitEthernet1 inside 192.168.1.2 255.255.255.0 manual
GigabitEthernet2 outside 192.168.2.2 255.255.255.0 manual
GigabitEthernet3 dmz 192.168.3.2 255.255.255.0 manual
ciscoasa(config)# router eigrp 100
ciscoasa(config-router)# network 192.168.1.0
ciscoasa(config-router)# network 192.168.2.0
ciscoasa(config-router)# network 192.168.3.0
ciscoasa(config-router)# exit
ciscoasa(config)# show eigrp neighbors
EIGRP-IPv4 neighbors for process 100
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
2 192.168.3.1 Gi3 11 00:18:43 19 200 0 4
1 192.168.2.1 Gi2 12 00:18:44 1019 5000 0 4
0 192.168.1.1 Gi1 11 00:18:45 641 3846 0 5
ciscoasa(config)# show route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
D 20.0.0.0 255.0.0.0 [90/156160] via 192.168.2.1, 0:18:05, outside
D 10.0.0.0 255.0.0.0 [90/156160] via 192.168.1.1, 0:18:06, inside
C 192.168.1.0 255.255.255.0 is directly connected, inside
C 192.168.2.0 255.255.255.0 is directly connected, outside
C 192.168.3.0 255.255.255.0 is directly connected, dmz
D 30.0.0.0 255.0.0.0 [90/156160] via 192.168.3.1, 0:18:04, dmz
