Cisco ASA 5500 Series Configuration Guide using ASDM, 6.3
Defining Route Maps
Downloads: This chapterpdf (PDF - 131.0KB) The complete bookPDF (PDF - 22.37MB) | Feedback

Defining Route Maps

Table Of Contents

Defining Route Maps

Route Maps Overview

Permit and Deny Clauses

Match and Set Clause Values

Licensing Requirements for Route Maps

Guidelines and Limitations

Defining a Route Map

Add/Edit a Route Map

Customizing a Route Map

Defining a Route to Match a Specific Destination Address

Configuring the Metric Values for a Route Action

Configuration Example for Route Maps

Feature History for Route Maps


Defining Route Maps


This chapter describes route maps and includes the following sections:

Route Maps Overview

Licensing Requirements for Route Maps

Guidelines and Limitations

Defining a Route Map

Customizing a Route Map

Configuration Example for Route Maps

Feature History for Route Maps

Route Maps Overview

Route maps are used when redistributing routes into an OSPF, RIP, or EIGRP routing process. They are also used when generating a default route into an OSPF routing process. A route map defines which of the routes from the specified routing protocol are allowed to be redistributed into the target routing process.

Route maps have many features in common with widely known access control lists (ACLs). These are some of the traits common to both mechanisms:

They are an ordered sequence of individual statements, each has a permit or deny result. Evaluation of ACL or route maps consists of a list scan, in a predetermined order, and an evaluation of the criteria of each statement that matches. A list scan is aborted once the first statement match is found and an action associated with the statement match is performed.

They are generic mechanisms—criteria matches and match interpretation are dictated by the way they are applied. The same route map applied to different tasks might be interpreted differently.

These are some of the differences between route maps and ACLs:

Route maps frequently use ACLs as matching criteria.

The main result from the evaluation of an access list is a yes or no answer—an ACL either permits or denies input data. Applied to redistribution, an ACL determines if a particular route can (route matches ACLs permit statement) or can not (matches deny statement) be redistributed. Typical route maps not only permit (some) redistributed routes but also modify information associated with the route, when it is redistributed into another protocol.

Route maps are more flexible than ACLs and can verify routes based on criteria which ACLs can not verify. For example, a route map can verify if the type of route is internal.

Each ACL ends with an implicit deny statement, by design convention; there is no similar convention for route maps. If the end of a route map is reached during matching attempts, the result depends on the specific application of the route map. Fortunately, route maps that are applied to redistribution behave the same way as ACLs: if the route does not match any clause in a route map then the route redistribution is denied, as if the route map contained deny statement at the end.

The dynamic protocol redistribute command allows you to apply a route map. In ASDM, this capability for redistribution can be found when you add or edit a new route map (see the "Defining a Route Map" section). Route maps are preferred if you intend to either modify route information during redistribution or if you need more powerful matching capability than an ACL can provide. If you simply need to selectively permit some routes based on their prefix or mask, we recommends that you use route map to map to an ACL (or equivalent prefix list) directly in the redistribute command. If you use a route map to selectively permit some routes based on their prefix or mask, you typically use more configuration commands to achieve the same goal.


Note You must use a standard ACL as the match criterion for your route map. Using an extended ACL will not work, and your routes will never be redistributed.


We recommend that you number clauses in intervals of 10, to reserve numbering space in case you need to insert clauses in the future.

This section includes the following topics:

Permit and Deny Clauses

Match and Set Clause Values

Permit and Deny Clauses

Route maps can have permit and deny clauses. In route-map ospf-to-eigrp, there is one deny clause (with sequence number 10) and two permit clauses. The deny clause rejects route matches from redistribution. Therefore, the following rules apply:

If you use an ACL in a route map using a permit clause, routes that are permitted by the ACL are redistributed.

If you use an ACL in a route map deny clause, routes that are permitted by the ACL are not redistributed.

If you use an ACL in a route map permit or deny clause, and the ACL denies a route, then the route map clause match is not found and the next route-map clause is evaluated.

Match and Set Clause Values

Each route map clause has two types of values:

matchSelects routes to which this clause should be applied.

setModifies information which will be redistributed into the target protocol.

For each route that is being redistributed, the router first evaluates the match criteria of a clause in the route map. If the match criteria succeed, then the route is redistributed or rejected as dictated by the permit or deny clause, and some of its attributes might be modified by the values set from the Set Value tab in ASDM or from the set commands. If the match criteria fail, then this clause is not applicable to the route, and the software proceeds to evaluate the route against the next clause in the route map. Scanning of the route map continues until a clause is found whose match command(s), or Match Clause as set from the Match Clause tab in ASDM, match the route or until the end of the route map is reached.

A match or set value in each clause can be missed or repeated several times, if one of these conditions exists:

If several match commands or Match Clause values in ASDM are present in a clause, all must succeed for a given route in order for that route to match the clause (in other words, the logical AND algorithm is applied for multiple match commands).

If a match command or Match Clause value in ASDM refers to several objects in one command, either of them should match (the logical OR algorithm is applied). For example, in the match ip address 101 121 command, a route is permitted if access list 101 or access list 121 permits it.

If a match command or Match Clause value in ASDM is not present, all routes match the clause. In the previous example, all routes that reach clause 30 match; therefore, the end of the route map is never reached.

If a set command, or Set Value in ASDM, is not present in a route map permit clause, then the route is redistributed without modification of its current attributes.


Note Do not configure a set command in a route map deny clause because the deny clause prohibits route redistribution—there is no information to modify.


A route map clause without a match or set command, or Match or Set Value as set on the Match or Set Value tab in ASDM, performs an action. An empty permit clause allows a redistribution of the remaining routes without modification. An empty deny clause does not allows a redistribution of other routes (this is the default action if a route map is completely scanned but no explicit match is found).

Licensing Requirements for Route Maps

Model
License Requirement

All models

Base License.


Guidelines and Limitations

This section includes the guidelines and limitations for this feature.

Context Mode Guidelines

Supported in single context mode.

Firewall Mode Guidelines

Supported only in routed mode. Transparent mode is not supported.

IPv6 Guidelines

Does not support IPv6.

Defining a Route Map

When defining which of the routes from the specified routing protocol are allowed to be redistributed into the target routing process, you must define a route map. This involves adding, editing, or deleting a route map.

Add/Edit a Route Map

In ASDM, you can define a route map by adding, editing, or deleting a route map name, sequence number, or redistribution.

To add, edit, or delete a route map, perform the following steps:


Step 1 In ASDM, choose Configuration > Device Setup > Routing > Route Maps.

Step 2 Click Add.

The Add Route Map or Edit Route Map dialog box appears.

Step 3 Enter the route map name and sequence number. The route map name is the name that you are giving a particular route. The sequence number is the order in which you add or delete the route map entries into the adaptive security appliance.


Note If you are editing an existing route map, the fields for Route Map name and sequence number are already filled in.


Step 4 To reject route matches from redistribution, click Deny. If you use an ACL in a route-map Deny clause, routes that are permitted by the ACL are not redistributed. To allow route matches for redistribution. click Permit. If you use an ACL in a route-map Permit clause, routes that are permitted by the ACL are redistributed.

In addition, if you use an ACL in a route-map Permit or Deny clause, and the ACL denies a route, then the route-map clause match is not found and the next route-map clause is evaluated.

Step 5 Click the Match Clause tab to choose routes to which this clause should be applied, and set the following parameters:

Check the Interface check box to enable or disable matching the first hop interface of a route or to match any routes with the specified next hop interface. If you specify more than one interface, then the route can match either interface.

Enter the interface name in the Interface field, or click the ellipses to display the Browse Interface dialog box.

Choose the interface type (inside or outside), click Selected Interface, and then click OK.

Check the IP check box to enable or disable matching of the IP address, Next Hop, or Route Source, This feature allows you to match any routes that have a destination network that matches a standard ACL. If you specify more than one ACL, then the route can match any of the ACLs. Additionally, you can match any routes that have been advertised by routers that match a standard ACL. If you specify more than one ACL, then the route can match any of the ACLs. When enabled, you can choose more than one item from the list.

Choose Match IP Address to enable or disable the Match address of a route or match packet.

Choose Match Next Hop to enable or disable the Match next hop address of a route.

Choose Match Route Source to enable or disable the Match advertising source address of route.

Click the ellipses to display the Browse Access List dialog box.

Choose the ACL that you want, and click Selected Access List, then click OK.

Check the Metric Value check box to enable or disable matching the metric of a route.

In the Metric Value field, type the metric values. You can enter multiple values, separated by commas. This value allows you to match any routes that have a specified metric. The metric value can range from 0 to 4294967295.

Check the Route Type check box to enable or disable matching of the route type. Valid route types are: External1, External2, Internal, Local, NSSA-External1, and NSSA-External2. When enabled, you can select more than one choice from the list.

Step 6 Click the Set Clause tab to modify the following information, which will be redistributed to the target protocol:

Select the Set Metric Clause check box to enable or disable the metric value for the destination routing protocol, and type the value in the Value field.

Select the Set Metric Type check box to enable or disable the type of metric for the destination routing protocol, and choose the metric type from the drop-down list.


Customizing a Route Map

This section describes how to customize the route map and includes the following topics:

Defining a Route to Match a Specific Destination Address

Configuring the Metric Values for a Route Action

Defining a Route to Match a Specific Destination Address

To define a route to match a specified destination address, perform the following steps:


Step 1 In ASDM, choose Configuration > Device Setup > Routing > Route Maps.

Step 2 Click Add.

The Add or Edit Route Map dialog box appears. From this dialog box you can assign or select the route map name, the sequence number and its redistribution access (that is, permit or deny). Route map entries are read in order. You can identify the order using the sequence number, or the adaptive security appliance uses the order in which you add the entries.

Step 3 Click the Match Clause tab to choose routes to which this clause should be applied, and set the following parameters:

Check the Interface check box to enable or disable matching the first hop interface of a route or to match any routes with the specified next hop interface. If you specify more than one interface, then the route can match either interface.

Enter the interface name in the Interface field, or click the ellipses to display the Browse Interface dialog box.

Choose the interface type (inside or outside), click Selected Interface, and then click OK.

Check the IP check box to enable or disable matching of the IP address, Next Hop, or Route Source, This feature allows you to match any routes that have a destination network that matches a standard ACL. If you specify more than one ACL, then the route can match any of the ACLs. Additionally, you can match any routes that have been advertised by routers that match a standard ACL. If you specify more than one ACL, then the route can match any of the ACLs. When enabled, you can choose more than one item from the list.

Choose Match IP Address to enable or disable the Match address of a route or match packet.

Choose Match Next Hop to enable or disable the Match next hop address of a route.

Choose Match Route Source to enable or disable the Match advertising source address of route.

Click the ellipses to display the Browse Access List dialog box.

Choose the ACL that you want, and click Selected Access List, then click OK.

Check the Metric Value check box to enable or disable matching the metric of a route.

In the Metric Value field, type the metric values. You can enter multiple values, separated by commas. This value allows you to match any routes that have a specified metric. The metric value can range from 0 to 4294967295.

Check the Route Type check box to enable or disable matching of the route type. Valid route types are: External1, External2, Internal, Local, NSSA-External1, and NSSA-External2. When enabled, you can select more than one choice from the list.


Configuring the Metric Values for a Route Action

To configure the metric value for a route action, perform the following steps:


Step 1 In ASDM, choose Configuration > Device Setup > Routing > Route Maps.

Step 2 Click Add.

The Add or Edit Route Map dialog box appears. From this dialog box you can assign or select the route map name, the sequence number and its redistribution access, that is, permit or deny. Route map entries are read in order. You can identify the order using the sequence number, or the adaptive security appliance uses the order in which you add the entries.

Step 3 Click the Set Clause tab to modify the following information, which will be redistributed to the target protocol:

Select the Set Metric Clause check box to enable or disable the metric value for the destination routing protocol, and type the value in the Value field.

Select the Set Metric Type check box to enable or disable the type of metric for the destination routing protocol, and choose the metric type from the drop-down list.


Configuration Example for Route Maps

The following example shows how to redistribute routes with a hop count equal to 1 into OSPF:


Step 1 In ASDM, choose Configuration > Device Setup > Routing > Route Maps.

Step 2 Click Add.

Step 3 Enter 1-to-2 in the Route Map Name field.

Step 4 Enter the routing sequence number in the Sequence Number field.

Step 5 Click the Permit radio button

By default this tab is on top.

Step 6 Click the Match Clause tab.

Step 7 Check the Match Metric of Route check box and type a value of 1 for the metric value.

Step 8 Click the Set Clause tab.

Step 9 Check the Set Metric Value check box, and type a value of 5 for the metric value.

Step 10 Check the Set Metric-Type check box, and choose Type-1.


Feature History for Route Maps

Table 20-1 lists each feature change and the platform release in which it was implemented. ASDM is backwards-compatible with multiple platform releases, so the specific ASDM release in which support was added is not listed.

Table 20-1 Feature History for Static and Default Routes

Feature Name
Platform Releases
Feature Information

Route mapping

7.0(1)

The route-map command allows you to define a route map entry.

The Configuration > Device Setup > Routing > Route Maps screen was introduced.

Enhanced support for static and dynamic route maps.

8.0(2)

Enhanced support for dynamic and static route maps was added.