User Guide for Cisco Security Manager 4.4

The General tab provides two identical sections; each is used to enable one OSPF process. The following options are available in each section.

Enable this OSPF Process

Check this box to enable an OSPF process. You cannot enable an OSPF process if you have RIP enabled on the security appliance. Deselect this option to remove the OSPF process.

OSPF Process ID

Enter a unique numeric identifier for the OSPF process. This process ID is used internally and does not need to match the OSPF process ID on any other OSPF devices. Valid values are from 1 to 65535.

Advanced button

Opens the OSPF Advanced Dialog Box, in which you can configure additional process-related parameters, such Router ID, Adjacency Changes, Administrative Route Distances, Timers, and Default Information Originate settings.

OSPF Process

Displays the ID of the OSPF process you are configuring. You cannot change this value in this dialog box.

Router ID

To use a fixed router ID, enter a router ID in IP address format in the Router ID field. If you leave this value blank, the highest-level IP address on the security appliance is used as the router ID.

Ignore LSA MOSPF

Select this option to suppress transmission of syslog messages when the security appliance receives Type 6 (MOSPF) LSA packets.

RFC 1583 Compatible

Select this option to calculate summary route costs per RFC 1583. Deselect this option to calculate summary route costs per RFC 2328. To minimize the chance of routing loops, all OSPF devices in an OSPF routing domain should have RFC compatibility set identically. This option is selected by default.

Adjacency Changes

These options specify the syslog messages sent when adjacency changes occur.

• Log Adjacency Changes – When selected, the security appliance sends a syslog message whenever an OSPF neighbor goes up or down. This option is selected by default.
• Log Adjacency Changes Detail – When selected, the security appliance sends a syslog message whenever any state change occurs, not just when a neighbor goes up or down. This option is not selected by default.

Administrative Route Distances

Settings for the administrative route distances, according to the route type.

• Inter Area – The administrative distance for all routes from one area to another. Valid values range from 1 to 255; the default value is 110.
• Intra Area – The administrative distance for all routes within an area. Valid values range from 1 to 255; the default value is 110.
• External – The administrative distance for all routes from other routing domains that are learned through redistribution. Valid values range from 1 to 255; the default value is 110.

Timers (in seconds)

Settings used to configure LSA pacing and SPF calculation timers.

• SPF Delay – The time between receipt of a topology change and the start of shortest path first (SPF) calculations. Valid values range from 0 to 65535; the default value is 5 seconds.
• SPF Hold – The hold time between consecutive SPF calculations. Valid values range from 1 to 65534; the default value is 10 seconds.
• LSA Group Pacing – The interval at which LSAs are collected into a group and refreshed, checksummed, or aged. Valid values range from 10 to 1800; the default value is 240 seconds.

Default Information Originate

Settings used by an ASBR to generate a default external route into an OSPF routing domain.

• Enable Default Information Originate – Check this box to enable generation of a default route into the OSPF routing domain; the following options become available:

– Always advertise the default route – Check this box to always advertise the default route.

– Metric Value – Enter the OSPF metric for the default route. Valid values range from 0 to 16777214; the default value is 1.

– Metric Type – Choose the external link type associated with the default route advertised into the OSPF routing domain. The choices are 1 or 2, indicating a Type 1 or a Type 2 external route. The default value is 2.

– Route Map – (Optional) The name of a route map to apply. The routing process generates the default route if the route map is satisfied.

Note This field contains only the Route Map name. The Route Map is created and contained within a FlexConfig; see Chapter 7, “Managing FlexConfigs” for more information.

OSPF Process

The OSPF process the area applies to.

Area ID

The area ID.

Area Type

The area type (Normal, Stub, or NSSA).

Networks

The area networks.

Options

The options, if any, set for the area type.

Authentication

The type of authentication set for the area (None, Password, or MD5).

Cost

The default cost for the area.

OSPF Process

When adding a new area, choose the OSPF process ID for the OSPF process for which the area is being added. If there is only one OSPF process enabled on the security appliance, that process is selected by default. When editing an existing area, you cannot change the OSPF process ID.

Area ID

When adding a new area, enter the area ID. You can specify the area ID as either a decimal number or an IP address. Valid decimal values range from 0 to 4294967295. You cannot change the area ID when editing an existing area.

Normal

Choose this option to make the area a standard OSPF area. This option is selected by default when you first create an area.

Stub

Choosing this option makes the area a stub area. Stub areas do not have any routers or areas beyond it. Stub areas prevent AS External LSAs (Type 5 LSAs) from being flooded into the stub area. When you create a stub area, you can prevent summary LSAs (Type 3 and 4) from being flooded into the area by deselecting the Summary check box.

Summary (allows sending LSAs into the stub area)

When the area being defined is a stub area, deselecting this check box prevents LSAs from being sent into the stub area. This check box is selected by default for stub areas.

NSSA

Choose this option to make the area a not-so-stubby area. NSSAs accept Type 7 LSAs. When you create a NSSA, you can prevent summary LSAs from being flooded into the area by deselecting the Summary check box. You can also disable route redistribution by deselecting the Redistribute check box and enabling Default Information Originate.

Redistribute (imports routes to normal and NSSA areas)

Deselect this check box to prevent routes from being imported into the NSSA. This check box is selected by default.

Summary (allows sending LSAs into the NSSA area)

When the area being defined is a NSSA, deselecting this check box prevents LSAs from being sent into the stub area. This check box is selected by default for NSSAs.

Default Information Originate (generate a Type 7 default)

Select this check box to generate a Type 7 default into the NSSA. This check box is deselected by default.

Metric Value

Specifies the OSPF metric value for the default route. Valid values range from 0 to 16777214. The default value is 1.

Metric Type

The OSPF metric type for the default route. The choices are 1 (Type 1) or 2 (Type 2). The default value is 2.

Network

The IP address and network mask of the network or host to be added to the area. Use 0.0.0.0 with a netmask of 0.0.0.0 to create the default area. You can only use 0.0.0.0 in one area.

Authentication

Contains the settings for OSPF area authentication.

• None—Choose this option to disable OSPF area authentication. This is the default setting.
• Password—Choose this option to use a clear text password for area authentication. This option is not recommended where security is a concern.
• MD5—Choose this option to use MD5 authentication.

Default Cost

Specify a default cost for the area. Valid values range from 0 to 65535. The default value is 1.

Process ID

The ID of the OSPF process associated with the route summary.

Area ID

The ID of the area associated with the route summary.

Network

The summary IP address and network mask.

Advertise

Displays “true” if the route summaries are advertised when they match the address/mask pair or “false” if the route summaries are suppressed when they match the address/mask pair.

OSPF Process

Select the OSPF process to which the route summary applies. You cannot change this value when editing an existing route summary entry.

Area

Select the area ID of the area to which the route summary applies. You cannot change this value when editing an existing route summary entry.

Network

The IP address and mask of the network for the routes being summarized.

Advertise

Select this check box to set the address range status to “advertise”. This causes Type 3 summary LSAs to be generated. Deselect this check box to suppress the Type 3 summary LSA for the specified networks.

OSPF Process

The OSPF process associated with the static neighbor.

Neighbor

The IP address of the static neighbor.

Interface

The interface associated with the static neighbor.

OSPF Process

The OSPF process associated with the static neighbor.

Neighbor

The IP address of the static neighbor.

Interface

The interface associated with the static neighbor.

OSPF Process

The OSPF process associated with the route redistribution entry.

Route Type

The source protocol the routes are being redistributed from. Valid entries are the following:

• Static—The route is a static route.
• Connected—The route was established automatically by virtue of having IP enabled on the interface.
• OSPF—The route is an OSPF route from another process.

Match

The conditions used for redistributing routes from one routing protocol to another.

Subnets

Displays “true” if subnetted routes are redistributed. Does not display anything if only routes that are not subnetted are redistributed.

Metric Value

The metric that is used for the route. This column is blank for redistribution entries if the default metric is used.

Metric Type

Displays “1” if the metric is a Type 1 external route, “2” if the metric is Type 2 external route.

Tag Value

A 32-bit decimal value attached to each external route. This value is not used by OSPF itself. It may be used to communicate information between ASBRs. Valid values range from 0 to 4294967295.

Route Map

The name of the route map to apply to the redistribution entry.

OSPF Process

Select the OSPF process associated with the route redistribution entry.

Route Type

Select the source protocol from which the routes are being redistributed. You can choose one of the following options:

• Static—The route is a static route.
• Connected—The route was established automatically by virtue of having IP enabled on the interface.
• OSPF—The route is an OSPF route from another process.

Match

The conditions used for redistributing routes from one routing protocol to another. The routes must match the selected condition to be redistributed. You can choose one or more of the following match conditions:

• Internal—The route is internal to a specific AS.
• External 1—Routes that are external to the autonomous system, but are imported into OSPF as Type 1 external routes.
• External 2—Routes that are external to the autonomous system, but are imported into OSPF as Type 2 external routes.
• NSSA External 1—Routes that are external to the autonomous system, but are imported into OSPF as Type 2 NSSA routes.
• NSSA External 2—Routes that are external to the autonomous system, but are imported into OSPF as Type 2 NSSA routes.

Metric Value

The metric value for the routes being redistributed. Valid values range from 1 to 16777214. When redistributing from one OSPF process to another OSPF process on the same device, the metric will be carried through from one process to the other if no metric value is specified. When redistributing other processes to an OSPF process, the default metric is 20 when no metric value is specified.

Metric Type

Select “1” if the metric is a Type 1 external route, “2” if the metric is a Type 2 external route.

Tag Value

The tag value is a 32-bit decimal value attached to each external route. This is not used by OSPF itself. It may be used to communicate information between ASBRs. Valid values range from 0 to 4294967295.

Use Subnets

When selected, redistribution of subnetted routes is enabled. Deselect this check box to cause only routes that are not subnetted to be redistributed.

Route Map

The name of the route map to apply to the redistribution entry.

OSPF Process

The OSPF process associated with the virtual link.

Area ID

The ID of the transit area.

Peer Router

The IP address of the virtual link neighbor.

Authentication

Displays the type of authentication used by the virtual link:

• None—No authentication is used.
• Password—Clear text password authentication is used.
• MD5—MD5 authentication is used.

OSPF Process

Select the OSPF process associated with the virtual link.

Area ID

Select the area shared by the neighbor OSPF devices. The selected area cannot be an NSSA or a stub area.

Peer Router

Enter the IP address of the virtual link neighbor.

Hello Interval

The interval, in seconds, between hello packets sent on an interface. The smaller the hello interval, the faster topological changes are detected but the more traffic is sent on the interface. This value must be the same for all routers and access servers on a specific interface. Valid values range from 1 to 65535 seconds. The default value is 10 seconds.

Retransmit Interval

The time, in seconds, between LSA retransmissions for adjacencies belonging to the interface. When a router sends an LSA to its neighbor, it keeps the LSA until it receives the acknowledgement message. If the router receives no acknowledgement, it will resend the LSA. Be conservative when setting this value, or needless retransmission can result. The value should be larger for serial lines and virtual links. Valid values range from 1 to 65535 seconds. The default value is 5 seconds.

Transmit Delay

The estimated time, in seconds, required to send an LSA packet on the interface. LSAs in the update packet have their ages increased by the amount specified by this field before transmission. If the delay is not added before transmission over a link, the time in which the LSA propagates over the link is not considered. The value assigned should take into account the transmission and propagation delays for the interface. This setting has more significance on very low-speed links. Valid values range from 1 to 65535 seconds. The default value is 1 second.

Dead Interval

The interval, in seconds, in which no hello packets are received, causing neighbors to declare a router down. Valid values range from 1 to 65535. The default value of this field is four times the interval set by the Hello Interval field.

Authentication

Contains the OSPF authentication options.

• None—Choose this option to disable OSPF authentication.
• Password—Choose this option to use clear text password authentication. This is not recommended where security is a concern.
• MD5—Choose this option to use MD5 authentication (recommended).

Authentication Password

Contains the settings for entering the password when password authentication is enabled.

• Password—Enter a text string of up to 8 characters.
• Confirm—Re-enter the password.

MD5 IDs and Keys

Contains the settings for entering the MD5 keys and parameters when MD5 authentication is enabled. All devices on the interface using OSPF authentication must use the same MD5 key and ID.

• MD5 Key ID and MD5 Key Table

– MD5 Key ID—A numerical key identifier. Valid values range from 1 to 255.

– MD5 Key—An alphanumeric character string of up to 16 bytes.

MD5 Key ID

A numerical key identifier. Valid values range from 1 to 255.

MD5 Key

An alphanumeric character string of up to 16 bytes.

Confirm

Re-enter the MD5 key.

OSPF Process

The OSPF process associated with the filter entry.

Area ID

The ID of the area associated with the filter entry.

Prefix List Name

The name of the prefix list.

Filtered Network

The IP address and mask of the network being filtered.

Traffic Direction

Displays “Inbound” if the filter entry applies to LSAs coming in to an OSPF area or “Outbound” if it applies to LSAs going out of an OSPF area.

Sequence #

The sequence number for the filter entry. When multiple filters apply to an LSA, the filter with the lowest sequence number is used.

Action

Displays “Permit” if LSAs matching the filter are allowed or “Deny” if LSAs matching the filter are denied.

Lower Range

The minimum prefix length to be matched.

Upper Range

The maximum prefix length to be matched.

OSPF Process

Select the OSPF process associated with the filter entry.

Area ID

Select the ID of the area associated with the filter entry.

Prefix List Name

Enter the prefix name.

Filtered Network

Enter the IP address and mask of the network being filtered.

Traffic Direction

Select the traffic direction to filter. Choose “Inbound” to filter LSAs coming into an OSPF area or “Outbound” to filter LSAs going out of an OSPF area.

Sequence Number

Enter a sequence number for the filter. Valid values range from 1 to 4294967294. When multiple filters apply to an LSA, the filter with the lowest sequence number is used.

Action

Select “Permit” to allow the LSA traffic or “Deny” to block the LSA traffic.

Lower Range

Specify the minimum prefix length to be matched. The value of this setting must be greater than the length of the network mask entered in the Filtered Network field and less than or equal to the value, if present, entered in the Upper Range field.

Upper Range

Enter the maximum prefix length to be matched. The value of this setting must be greater than or equal to the value, if present, entered in the Lower Range field, or, if the Lower Range field is left blank, greater than the length of the network mask length entered in the Filtered Network field.

OSPF Process

The OSPF process associated with the summary address.

Network

The IP address and network mask of the summary address.

Tag

A 32-bit decimal value attached to each external route. This value is not used by OSPF itself. It may be used to communicate information between ASBRs.

Advertise

Displays “true” if the summary routes are advertised. Displays “false” if the summary route is not advertised.

OSPF Process

Choose the OSPF process associated with the summary address. You cannot change this information when editing an existing entry.

Network

The IP address and network mask of the summary address.

Tag

The tag value is a 32-bit decimal value attached to each external route. This is not used by OSPF itself. It may be used to communicate information between ASBRs. Valid values range from 0 to 4294967295.

Advertise

When selected, summary routes are advertised. Deselect this check box to suppress routes that fall under the summary address. By default, this check box is selected.

Interface

The name of the interface to which the configuration applies.

Authentication

The type of OSPF authentication enabled on the interface. The authentication type can be one of the following values:

• None—OSPF authentication is disabled.
• Password—Clear text password authentication is enabled.
• MD5—MD5 authentication is enabled.
• Area—The authentication type specified for the area is enabled on the interface. Area authentication is the default value for interfaces. However, area authentication is disabled by default. So, unless you previously specified an area authentication type, interfaces showing Area authentication have authentication disabled.

Point-to-Point

Displays “true” if the interface is set to non-broadcast (point-to-point). Displays “false” if the interface is set to broadcast.

Cost

The cost of sending a packet through the interface.

Priority

The OSPF priority assigned to the interface.

MTU Ignore

Displays “false” if MTU mismatch detection is enabled. Displays “true” if the MTU mismatch detection is disabled.

Database Filter

Displays “true” if outgoing LSAs are filtered during synchronization and flooding. Displays “false” if filtering is not enabled.

Hello Interval

The interval, in seconds, between hello packets sent on an interface. The smaller the hello interval, the faster topological changes are detected but the more traffic is sent on the interface. This value must be the same for all routers and access servers on a specific interface. Valid values range from 1 to 65535 seconds. The default value is 10 seconds.

Transmit Delay

The estimated time, in seconds, required to send an LSA packet on the interface. LSAs in the update packet have their ages increased by the amount specified by this field before transmission. If the delay is not added before transmission over a link, the time in which the LSA propagates over the link is not considered. The value assigned should take into account the transmission and propagation delays for the interface. This setting has more significance on very low-speed links. Valid values range from 1 to 65535 seconds. The default value is 1 second.

Retransmit Interval

The time, in seconds, between LSA retransmissions for adjacencies belonging to the interface. When a router sends an LSA to its neighbor, it keeps the LSA until it receives the acknowledgement message. If the router receives no acknowledgement, it resends the LSA. Be conservative when setting this value, or needless retransmission can result. The value should be larger for serial lines and virtual links. Valid values range from 1 to 65535 seconds. The default value is 5 seconds.

Dead Interval

The interval, in seconds, in which no hello packets are received, causing neighbors to declare a router down. Valid values range from 1 to 65535. The default value of this setting is four times the interval set by the Hello Interval field.

Interface

The name of the interface to which the configuration applies.

Authentication

The type of OSPF authentication enabled on the interface. The authentication type can be one of the following values:

• No Authentication—OSPF authentication is disabled.
• Area Authentication—The authentication type specified for the area is enabled on the interface. Area authentication is the default value for interfaces. However, area authentication is disabled by default. So, unless you previously specified an area authentication type, interfaces showing Area authentication have authentication disabled.
• Password Authentication—Clear text password authentication is enabled.
• MD5 Authentication—MD5 authentication is enabled.

Authentication Password

Contains the settings for entering the password when password authentication is enabled.

• Enter Password—Enter a text string of up to 8 characters.
• Confirm—Re-enter the password.

MD5 Key IDs and Keys

Contains the settings for entering the MD5 keys and parameters when MD5 authentication is enabled. All devices on the interface using OSPF authentication must use the same MD5 key and ID.

• Key ID—Enter a numerical key identifier. Valid values range from 1 to 255.
• Key—An alphanumeric character string of up to 16 bytes.
• Confirm—Re-enter the MD5 key.

Cost

The cost of sending a packet through the interface.

Priority

The OSPF priority assigned to the interface.

MTU Ignore

When selected, MTU mismatch detection is disabled. Deselect this check box to enable MTU mismatch detection.

Database Filter All Out

When selected, outgoing LSAs are filtered during synchronization and flooding. Deselect this check box to disable filtering.

Hello Interval (sec)

The interval, in seconds, between hello packets sent on an interface. The smaller the hello interval, the faster topological changes are detected but the more traffic is sent on the interface. This value must be the same for all routers and access servers on a specific interface. Valid values range from 1 to 65535 seconds. The default value is 10 seconds.

Transmit Delay (sec)

The estimated time, in seconds, required to send an LSA packet on the interface. LSAs in the update packet have their ages increased by the amount specified by this field before transmission. If the delay is not added before transmission over a link, the time in which the LSA propagates over the link is not considered. The value assigned should take into account the transmission and propagation delays for the interface. This setting has more significance on very low-speed links. Valid values range from 1 to 65535 seconds. The default value is 1 second.

Retransmit Interval (sec)

The time, in seconds, between LSA retransmissions for adjacencies belonging to the interface. When a router sends an LSA to its neighbor, it keeps the LSA until it receives the acknowledgment message. If the router receives no acknowledgment, it will resend the LSA. Be conservative when setting this value, or needless retransmission can result. The value should be larger for serial lines and virtual links. Valid values range from 1 to 65535 seconds. The default value is 5 seconds.

Dead Interval (sec)

The interval, in seconds, in which no hello packets are received, causing neighbors to declare a router down. Valid values range from 1 to 65535. The default value of this setting is four times the interval set by the Hello Interval field.

Point-to-Point

Displays “true” if the interface is set to non-broadcast (point-to-point). Displays “false” if the interface is set to broadcast.

OSPFv3 Process

Identify which OSPFv3 process you are configuring: choose Process 1 or Process 2. You can enable one or both.

Enable OSPFv3 Process

Check this box to enable the chosen OSPFv3 process. Deselect this option to disable the OSPFv3 process; the process configuration information is retained should you wish to re-enable it later.

Process ID

Enter a unique numeric identifier for this process. The ID can be any positive integer between 1 and 65535.

This process ID is used internally and does not need to match the OSPFv3 process ID on any other OSPFv3 devices.

Advanced

Opens the OSPFv3 Advanced Properties Dialog Box, in which you can configure additional process-related parameters, such Router ID, Adjacency Changes, Administrative Route Distances, Timers, Default Information Originate, and Passive Interface settings.

Area

Use the tabs and tables in this panel to manage area, range and virtual-link definitions. See Area Tab (OSPFv3) for more about these definitions.

Redistribution

Use this panel to manage redistribution definitions. See Add/Edit Redistribution Dialog Box (OSPFv3) for more about these definitions.

Summary Prefix

Use this panel to manage summary prefix definitions. See Add/Edit Summary Prefix Dialog Box (OSPFv3) for more about these definitions.

OSPF Process

This read-only field displays the ID of the OSPF process you are configuring.

Router ID

On a single device, choose Automatic or IP Address. (An address field appears when you choose IP Address.)

If you choose Automatic, the highest-level IP address on the security appliance is used as the router ID. To use a fixed router ID, choose IP Address and enter an IPv4 address in the Router ID field.

On a device cluster, choose Automatic or Cluster Pool. (An IPv4 Pool object ID field appears when you choose Cluster Pool.)

If you choose Cluster Pool, enter or Select the name of the IPv4 Pool object that is to supply the Router ID address. For more information, see Add or Edit IPv4 Pool Dialog Box.

Ignore LSA MOSPF

Select this option to suppress transmission of syslog messages when the security appliance receives Type 6 (MOSPF) LSA packets.

Adjacency Changes

These options specify the syslog messages sent when adjacency changes occur:

• Log Adjacency Changes – When selected, the security appliance sends a syslog message whenever an OSPF neighbor goes up or down. Checking this box enables the Include Details option.
• Include Details – When selected, the security appliance sends a syslog message whenever any state change occurs, not just when a neighbor goes up or down. This option is available only when Log Adjacency Changes is checked.

Administrative Route Distances

Settings for the administrative route distances, according to the route type.

• Inter Area – The administrative distance for all routes from one area to another. Valid values range from 1 to 254; the default value is 110.
• Intra Area – The administrative distance for all routes within an area. Valid values range from 1 to 254; the default value is 110.
• External – The administrative distance for all routes from other routing domains that are learned through redistribution. Valid values range from 1 to 254; the default value is 110.

Timers (in milliseconds)

LSA and SPF throttling provide a dynamic mechanism to slow LSA updates in OSPFv3 during times of network instability, and allow faster OSPFv3 convergence by providing LSA rate limiting. The settings used to configure LSA pacing and SPF calculation timers are:

• LSA Arrival – The minimum delay between acceptance of the same LSA arriving from neighbors. Valid values range from 0 to 6000000 milliseconds. The default is 1000.
• LSA Flood Pacing – The amount of time LSAs in the flooding queue are paced in between updates. Valid values range from 5 to 100 milliseconds. The default value is 33.
• LSA Group Pacing – The interval at which LSAs are collected into a group and refreshed, check summed, or aged. Valid values range from 10 to 1800; the default value is 240 milliseconds.
• LSA Retransmission Pacing – The length of time at which LSAs in the retransmission queue are paced. Valid values range from 5 to 200 milliseconds. The default value is 66.
• LSA Throttle – The delay in milliseconds to generate the first occurrence of the LSA. Valid values range from 0 to 600000 milliseconds. When you enter a value in this field, the min and max fields are enabled:

– min – The minimum delay for originating the same LSA. Valid values range from 1 to 600000 milliseconds.

– max – The maximum delay for originating the same LSA. Valid values range from 1 to 600000 milliseconds.

• SPF Throttle – The delay to receive a change to the SPF calculation. Valid values range from 1 to 600000 milliseconds. When you enter a value in this field, the min and max fields are enabled:

– min – The delay between the first and second SPF calculations. Valid values range from 1 to 600000 milliseconds.

– max – The maximum wait time for SPF calculations. Valid values range from 1 to 600000 milliseconds.

Note Note For LSA throttling, if the minimum or maximum time is less than the first occurrence value, then OSPFv3 automatically corrects to the first occurrence value. Similarly, if the maximum delay specified is less than the minimum delay, then OSPFv3 automatically corrects to the minimum delay value.

Default Information Originate

Settings used by an ASBR to generate a default external route into an OSPFv3 routing domain:

• Enable Default Information Originate – Check this box to enable generation of a default route into the OSPFv3 routing domain; the following options become available:

– Always advertise the default route – Check this box to always advertise the default route.

– Metric Value – The OSPFv3 metric used to generate the default route. Valid values range from 0 to 16777214.

– Metric Type – The external link type associated with the default route advertised into the OSPFv3 routing domain. Choose 1 or 2, indicating a Type 1 or a Type 2 external route. The default value is 1.

– Route Map – (Optional) The name of a route map to apply. The routing process generates the default route if the route map is satisfied.

Note This field contains only the Route Map name. The Route Map is created and contained within a FlexConfig; see Chapter 7, “Managing FlexConfigs” for more information.

Passive Interface

Passive routing helps control the advertisement of OSPFv3 routing information, and disables sending and receiving OSPFv3 routing updates on an interface.

Enter or Select one or more interfaces, or interface objects, to enable passive OSPFv3 routing on those interfaces. IPv4 and IPv6 addresses are supported.

Area ID

Enter an identifier for the area as either a decimal number or an IP address. Valid decimal values range from 0 to 4294967295.

Cost

The cost of sending a packet on an interface. Valid values are 0 to 65535.

Routing decisions are based on cost, which is an indication of the overhead required to send packets across a certain interface. The ASA calculates the cost of an interface based on link bandwidth rather than the number of hops to the destination. The cost can be configured to specify preferred paths.

Type

Define the area type by choosing one of the following:

• Normal – Make the area a standard OSPFv3 area. This option is selected by default when you first create an area.
• NSSA – Make the area a “not-so-stubby area.” NSSAs accept Type 7 LSAs. When you choose this option, the Default Information Originate options are enabled.

When you create a NSSA, you can prevent summary LSAs from being flooded into the area by deselecting Allow sending summary LSA into this area. You can also disable route redistribution by deselecting Redistribute, and enabling Default information originate.

• Stub – Make the area a stub area. Stub areas do not have any routers or areas beyond it. Stub areas prevent AS External LSAs (Type 5 LSAs) from being flooded into the stub area. When you choose this option, Allow sending summary LSA into this area is enabled.

When you create a stub area, you can prevent summary LSAs (Type 3 and 4) from being flooded into the area by deselecting Allow sending summary LSA into this area.

Default Information Originate

These options are enabled when you choose NSSA as the area Type. The first option is enabled when you choose Stub as the area Type.

Allow sending summary LSA into this area

Select to allow flooding of summary LSAs into the area.

Redistribute (imports routes to normal and NSSA areas)

Select to allow route redistribution.

Default information originate

Check this box to generate a Type 7 default into the NSSA. Selecting this option enables the following metric options:

• Metric – The OSPF metric value for the default route. Valid values range from 1 to 16777214. The default is 1.
• Metric Type – The OSPF metric type for the default route. Choose 1 (Type 1) or 2 (Type 2). The default is 1.

Area ID

This read-only entry is the ID of the area to which this range applies.

IPv6 Prefix/Length

The IPv6 address(es) for the routes being summarized.

Cost

The cost for the summary route, which is used during OSPF SPF calculations to determine the shortest paths to the destination. Valid values are 0 to 16777215.

Routing decisions are based on cost, which is an indication of the overhead required to send packets across a certain interface. The ASA calculates the cost of an interface based on link bandwidth rather than the number of hops to the destination. The cost can be configured to specify preferred paths.

Advertise

Select this option to set the address range status to advertise. This causes Type 3 summary LSAs to be generated (this is the default). Deselect this optionn to suppress the Type 3 summary LSAs for the specified networks.

Area ID

This read-only entry is the ID of the area to which this virtual link applies.

Peer Router ID

Enter the IP address of the virtual link neighbor.

TTL Security

The time-to-live (TTL) security hop count on a virtual link. The hop count value can range from 1 to 254.

Dead Interval

The interval, in seconds, if no hello packets are received, neighbors declare the device down. Valid values range from 1 to 8192. The default value of this field is four times the Hello Interval.

Hello Interval

The interval, in seconds, between hello packets sent on an interface. The smaller the hello interval, the faster topological changes are detected but the more traffic is sent on the interface. This value must be the same for all routers and access servers on a specific interface. Valid values range from 1 to 8192 seconds. The default value is 10 seconds.

Transmit Interval

The time, in seconds, between LSA retransmissions for adjacencies belonging to the interface. When a device sends an LSA to its neighbor, it keeps the LSA until it receives the acknowledgment message. If the device does not receive an acknowledgment, it will resend the LSA. Be conservative when setting this value, or needless retransmission can result. The value should be larger for serial lines and virtual links. Valid values range from 1 to 8192 seconds. The default value is 5 seconds.

Transmit Delay

The estimated time, in seconds, required to send an LSA packet on the interface. LSAs in the update packet have their ages increased by the amount specified by this field before transmission. If the delay is not added before transmission over a link, the time in which the LSA propagates over the link is not considered. The value assigned should take into account the transmission and propagation delays for the interface. This setting has more significance on very low-speed links. Valid values range from 1 to 8192 seconds. The default value is 1 second.

Source Protocol

Choose the source protocol for route redistribution:

• Connected – Redistributes connected routes (routes established automatically by virtue of having an IP address enabled on the interface) to the OSPFv3 routing process. Connected routes are redistributed as external to the autonomous system.
• OSPF – Redistributes routes from another OSPF routing process. The Routing PID and the Match options are enabled when you choose this option.
• Static – Redistributes static routes to the OSPFv3 routing process.

Metric

The metric value for the routes being redistributed. Valid values range from 1 to 16777214; the default is 20.

When redistributing from one OSPF process to another OSPF process on the same device, the metric will be carried through from one process to the other if no metric value is specified.

Metric Type

The metric type is the external link type associated with the default route that is advertised into the OSPFv3 routing domain.

Choose None, 1, or 2, where None indicates there is no default route, 1 indicates the metric is a Type 1 external route, and 2 is a Type 2 external route.

Tag (optional)

The tag is a 32-bit decimal value attached to each external route. This is not used by OSPF itself. It may be used to communicate information between other border devices. Valid values range from 0 to 4294967295.

Route Map

The name of the route map to apply to the redistribution entry.

Note This field contains only the Route Map name. The Route Map is created and contained within a FlexConfig; see Chapter 7, “Managing FlexConfigs” for more information.

Routing PID

The ID of the process to which redistribution is directed. (The Process ID is defined on the Process Tab.)

This option is enabled only when OSPF is chosen as the Source Protocol.

Include Connected

Check this box to include connected routes in the redistribution.

Match

The conditions used for redistributing routes from one routing protocol to another. The routes must match the selected condition to be redistributed. You can choose one or more of the following match conditions. These options are enabled only when OSPF is chosen as the Source Protocol.

Internal

The route is internal to a specific autonomous system.

External 1

Routes that are external to the autonomous system, but are imported into OSPF as Type 1 external routes.

External 2

Routes that are external to the autonomous system, but are imported into OSPF as Type 2 external routes.

NSSA External 1

Routes that are external to the autonomous system, but are imported into OSPF as Type 2 NSSA routes.

NSSA External 2

Routes that are external to the autonomous system, but are imported into OSPF as Type 2 NSSA routes.

Process ID

This read-only value identifies the process to which this rule applies.

IPv6 Prefix/Length

Enter an IPv6 prefix/length for external route summarization.

Advertise

When selected, summary routes that match the specified prefix and mask pair are advertised. When deselected, routes that match the specified prefix and mask pair are suppressed. By default, this check box is selected.

Tag (optional)

The tag is a 32-bit decimal value attached to each external route. This is not used by OSPF itself. It may be used to communicate information between border devices. Valid values range from 0 to 4294967295.

This field is enabled when you check Advertise.

Interface

The name of the interface to which this routing configuration applies.

Enable OSPFv3 on this interface

Check this box to enable OSPFv3 on the specified interface, and activate the following fields:

• Process ID – Choose the process to apply to this interface; defined on the OSPFv3 Process Tab.
• Area ID – Identify the area to be assigned; areas are also defined on the OSPFv3 Process Tab.
• Instance ID – (Optional) Specify an ID for this process instance. Valid values for this setting range from 0 to 255.

This feature lets you have multiple OSPFv3 processes on a single link. Received packets with other instance IDs are then ignored by this process.

Filter outgoing link-state advertisements

Check this box to filter outgoing LSAs. All outgoing LSAs are flooded to the interface by default.

Disable MTU mismatch detection

Check this box to disable the OSPFv3 MTU mismatch detection when database description (DBD) packets are received.

Flood Reduction

Check this box to suppress unnecessary flooding of LSAs in stable topologies.

Point-to-point Network

Check this box to define this as a link to a point-to-point network; that is, a network between two routing devices. All neighbors on a point-to-point network establish adjacency and there is no designated router.

This option is unavailable when the Broadcast option is selected.

Broadcast

Check this box to define this as a link to a network with multiple routing devices. Such networks establish a designated router (DR), as well as a backup designated router (BDR), that controls LSA flooding on the network.

This option is unavailable when the Point-to-point Network option is selected.

Cost

The cost of sending a packet through the interface. Link cost is an arbitrary number used in shortest path first calculations. If you do not assign a value, the configured reference bandwidth divided by the interface port speed is used. (The default reference bandwidth is 40 Gb/sec.)

Priority

Assign an OSPFv3 priority to this interface. Valid values for this setting range from 0 to 255. Entering 0 for this setting makes the device ineligible to become the designated router or backup designated router. This setting does not apply to interfaces that are configured as point-to-point, non-broadcast interfaces.

When two routing devices connect to a network, both attempt to become the designated router. The device with the higher priority becomes the designated router. If there is a tie, the router with the higher router ID becomes the designated router.

Dead Interval

If no hello packets are received from a neighbor within this interval, that device is designated as inactive. Valid values range from 1 to 65535. The default value for this setting is four times the hello interval.

Poll Interval

If a neighboring device is inactive, it may be necessary to continue sending hello packets to that neighbor. The hello packets are sent at this reduced interval, which should be larger than the hello interval.

Retransmit Interval

The time, in seconds, between LSA retransmissions for adjacent neighbors. When a router sends an LSA to a neighbor, it keeps the LSA until it receives an acknowledgment. If an acknowledgment is not received within this interval, it will resend the LSA. Be conservative when setting this value, or needless retransmission can result. The value should be larger for serial lines and virtual links. Valid values range from 1 to 65535 seconds.

Transmit Delay

The estimated time, in seconds, required to send an LSA packet on the interface. LSAs in the update packet have their ages increased by the amount specified by this field before transmission. If the delay is not added before transmission over a link, the time in which the LSA propagates over the link is not considered. The value assigned should take into account the transmission and propagation delays for the interface. This setting has more significance on very low-speed links. Valid values range from 1 to 65535 seconds.

Type

The type of authentication enabled on this interface. Choose one of the following:

• Area – OSPFv3 does not provide “built-in” authentication, instead relying on IPv6/IPSec protocols. Choose this option to use those protocols to authenticate OSPFv3 traffic on all interfaces in the area; this means all routing devices in the area must use this option. This is the default.
• Interface – Choose this option to secure this interface and protect OSPFv3 virtual links. The additional parameters in this section are enabled when you choose this option.
• None – OSPFv3 authentication is disabled.

Security Parameter Index

Enter an IPSec identification tag used to distinguish this particular OSPFv3 interface; used in conjunction with the specified authentication and encryption rules. Valid values range from 256 to 4294967295.

Authentication Algorithm

Choose the type of authentication algorithm to use:

• md5 – Message Digest 5; produces a 128-bit hash value.
• sha1 – Secure Hash Algorithm version 1; produces a 160-bit hash value.

Authentication Key

Enter an authentication key. The length of the key entered depends on the type of authentication chosen as the Authentication Algorithm, and whether the key is to be encrypted (when you check the Encrypt Authentication Key box):

• md5 – 32 characters.
• md5 (encrypted) – 66 characters.
• sha1 – 40 characters.
• sha1 (encrypted) – 82 characters.

Encrypt Authentication Key

Check this box to require encryption of the specified Authentication Key for transmission.

Include Encryption

Check this box to require encryption of OSPFv3 packets. The following options are enabled.

Encryption Algorithm

Choose the type of encryption to use:

• 3des – Triple DES; the Data Encryption Standard cipher algorithm is applied three times to each packet.
• aes-cbc – Encryption is based on the Advanced Encryption Standard with Cipher Block Chaining, to produce a key of the size chosen with the Key Type parameter.

The Key Type list is enabled only when you choose this encryption option. Choose one of these options:

– 128 – For 128-bit keys.

– 192 – For 192-bit keys.

– 256 – For 256-bit keys.

• des – Encryption is based on the Data Encryption Standard, using 56-bit keys.

Encryption Key

Enter an encryption key. The length of the key entered depends on the type of encryption chosen as the Encryption Algorithm, and whether the key is to be encrypted (when you check the Encrypt Key box):

• 3des – 48 characters (192 bits).
• 3des (encrypted) – 98 characters (192 bits).
• aes-cbc/128 – 32 characters (128 bits).
• aes-cbc/128 (encrypted) – 66 characters (128 bits).
• aes-cbc/192 – 48 characters (192 bits).
• aes-cbc/192 (encrypted) – 98 characters (192 bits).
• aes-cbc/256 – 64 characters (256 bits).
• aes-cbc/256 (encrypted) – 130 characters (256 bits).
• des – 16 characters (64 bits).
• des (encrypted) – 34 characters (64 bits).

Encrypt Key

Check this box to require encryption of the specified Encryption Key for transmission.

Interface

The interface associated with this neighbor definition (read-only).

Link-local Address

Enter the IPv6 address of the static neighbor.

Cost and Database Filter

Check this box to enable filtering of the outgoing LSAs on the interface during synchronization and flooding. The following options are enabled:

• Cost – Use this field to assign an arbitrary cost to this neighbor. If a value is not assigned, the cost of the interface is used (this value is based on the port speed of the interface, and is calculated as reference bandwith divided by interface speed). Valid values range from 1 to 65535.
• Filter outgoing link-state advertisements – Check this box to disable forwarding of outgoing LSAs to this neighbor.

Note The Cost and Database Filter options and the Poll-Interval options are mutually exclusive.

Poll-Interval

Check this box to enable the following options:

• Poll Interval – Time interval in seconds between transmission of hello packets to a “dead” neighbor. The default is 120.

If a neighboring device becomes inactive (hello packets have not been received for the dead interval period), it may be necessary to continue sending hello packets to the dead neighbor at a reduced rate. Thus this value should be larger than the interface hello interval.

• Priority – The router priority value of this neighbor. The default is 0; valid values range from 1 to 255.

The priority value helps determine the designated router for an OSPFv3 link. A value of zero means the device is ineligible to become the designated router, or backup designated router.

Note The Poll-Interval options and the Cost and Database Filter options are mutually exclusive. Also, these values do not apply to point-to-multipoint interfaces.

Interface

Enter or Select the interface for the RIP configuration. You cannot configure two different RIP configurations on the same interface.

Mode

Select the interface behavior regarding RIP updates:

• Send default routes – The interface will transmit RIP routing updates only.
• Receive routes – The interface will listen for RIP routing broadcasts and use that information to populate its routing table, but it will not send RIP routing updates.
• Send default routes and receive routes – The interface will send and receive RIP routing updates.

Version

Select the RIP version to enable on the interface:

• RIP Version 1 – Enables RIP Version 1 on the interface.
• RIP Version 2 – Enables RIP Version 2 on the interface. Configuring RIP Version 2 registers the multicast address 224.0.0.9 on the interface.

Version 2 Authentication

These options let you enable and select the type of authentication used with RIP Version 2.

• Enable Authentication – This option is available when you select RIP Version 2 above. When this box is checked, RIP neighbor authentication is enabled and the following options become available:

– Type – Select MD5 to use the MD5 hash algorithm for authentication (recommended), or select Clear text to use clear text for authentication.

– Key ID – The identification number of the authentication key. This number must be shared with all other devices sending updates to and receiving updates from the security appliance. Valid values range from 1 to 255.

– Key – The shared key used for authentication. This key must be shared with all other devices sending updates to and receiving updates from the security appliance. The key can be up to 16 characters.

Networks

Define one or more networks for RIP routing. Enter IP address(es), or enter or Select the desired Network/Hosts objects (see Understanding Networks/Hosts Objects); IP addresses must not contain any subnet information. There is no limit to the number of networks you can add to the security appliance configuration.

The RIP routing updates will be sent and received only through interfaces on the specified networks. Also, if the network of an interface is not specified, the interface will not be advertised in any RIP updates.

Passive Interface

Use this option to specify passive interfaces on the security appliance, and by extension the active interfaces. The device listens for RIP routing broadcasts on passive interfaces, using that information to populate its routing tables, but does not broadcast routing updates on passive interfaces. Interfaces that are not designated as passive, receive and send updates. Choose one of these options:

1. None – No interfaces are designated as passive.

2. All Interfaces – All interfaces on the device are designated as passive, except those entered the Excluded Interfaces field below.

3. Specified Interfaces – Only those interfaces explicitly specified in the Interfaces field below are designated as passive.

Interfaces/Excluded Interfaces

Use this field to specify the interfaces excluded from the passive list, or those explicitly designated as passive, depending on your choice from the Passive Interface list above:

• If you chose All Interfaces, this field is labeled Excluded Interfaces : enter or Select only those interfaces to be excluded (that is, those that are to be active not passive).
• If you chose Specified Interfaces in the Passive Interface list, enter or Select those interfaces that are to be designated as passive.

Note You cannot specify two different RIP configurations for the same interface.

RIP Version

Choose the RIP versions for sending and receiving RIP updates:

• Receive Version 1 and 2, Send Version 1
• Send and Receive Version 1
• Send and Receive Version 2

Generate Default Route

When selected, a default route is generated for distribution, based on the Route Map you specify.

Route Map

Specify the route map to use for generating default routes.

Note This field contains only the Route Map name. The Route Map is created and contained within a FlexConfig; see Chapter 7, “Managing FlexConfigs” for more information.

Enable Auto-Summary

When Send and Receive Version 2 is the chosen RIP Version, this option is available. When checked, automatic route summarization is enabled. Disable automatic summarization if you must perform routing between disconnected subnets. When automatic summarization is disabled, subnets are advertised.

Note RIP Version 1 always uses automatic summarization—you cannot disable it.

Protocol to Redistribute

Choose the routing protocol to redistribute into the RIP routing process:

• Static – Static routes.
• Connected – Directly connected networks.
• OSPF – Routes discovered by the OSPF routing process.

If you choose OSPF, you must also enter the OSPF Process ID and, optionally, Match criteria.

Process ID

Enter the process ID when the OSPF protocol is chosen.

Match

If you are redistributing OSPF routes into the RIP routing process, you can select specific types of OSPF routes to redistribute. Ctrl-click to select multiple types:

• Internal – Routes internal to the autonomous system (AS) are redistributed.
• External 1 – Type 1 routes external to the AS are redistributed.
• External 2 – Type 2 routes external to the AS are redistributed.
• NSSA External 1 – Type 1 routes external to a not-so-stubby area (NSSA) are redistributed.
• NSSA External 2 – Type 2 routes external to an NSSA are redistributed.

Match criteria are optional. The default is match Internal, External 1, and External 2.

Metric

The RIP metric type to apply to the redistributed routes. The two choices are:

• Transparent – Use the current route metric.
• Specified Value – Assign a specific metric value.

Metric Value

The metric value to be assigned; enter a value from 0 to 16.

Route Map

The name of a route map that must be satisfied before the route can be redistributed into the RIP routing process.

Note This field contains only the route Map name. The contents of the route map are created and contained within a FlexConfig. See Chapter 7, “Managing FlexConfigs” for more information.

Traffic Direction

Choose the type of traffic to be filtered: Inbound or Outbound.

Note If Traffic Direction is Inbound, you can define an Interface filter only.

Filter On

Specify whether the filter is based on an Interface or a Route.

If you select Interface, enter or Select the name of the interface on which routing updates are to be filtered.

If you select Route, choose the route type:

• Static – Only static routes are filtered.
• Connected – Only connected routes are filtered.
• OSPF – Only OSPF routes discovered by the specified OSPF process are filtered. Enter the Process ID of the OSPF process to be filtered.

Filter ACLs

Enter or Select the name of one or more access control lists (ACLs) that define the networks to be allowed or removed from RIP route advertisements.

Interface

Enter or Select an interface defined on this appliance.

Send (Version)

These options let you override, for this interface, the global Send versions specified on the RIP - Setup Tab. Select the appropriate boxes to specify sending updates using RIP Version 1, Version 2, or both.

Receive (Version)

These options let you override the global Receive versions. Select the appropriate boxes to specify accepting updates using RIP Version 1 only, Version 2 only, or both.

Authentication type

Choose the authentication used on this interface for RIP broadcasts:

• None – No authentication.
• MD5 – Employ MD5.
• Clear Text – Employ clear-text authentication.

If you choose MD5 or Clear Text, you must also provide the following authentication parameters:

• Key ID – The ID of the authentication key. Valid values are from 0 to 255.
• Key – The key used by the chosen authentication method. Can contain up to 16 characters.
• Confirm – Enter the authentication key again, to confirm.

Interface

Enter or Select the interface to which this static route applies.

Network

Enter or Select the destination network(s). You can provide one or more IP address/netmask entries, one or more Networks/Hosts objects, or a combination of both; separate the entries with commas.

Enter “0.0.0.0/0” or “any” to specify a default route.

Gateway

Enter or Select the gateway router which is the next hop for this route. You can provide an IP address, or a Networks/Hosts object.

Note If an IP address from one of the security appliance’s interfaces is used as the Gateway IP address, the security appliance will resolve the designated IP address in the packet instead of resolving the Gateway IP address.

Metric

The Metric is a measurement of the “expense” of a route, based on the number of hops (hop count) to the network on which a specific host resides. Hop count is the number of networks that a network packet must traverse, including the destination network, before it reaches its final destination. Because the hop count includes the destination network, all directly connected networks have a metric of 1.

Enter the number of hops to the destination network. Valid values range from 1 to 255; the default value is 1.

The maximum number of equal-cost (equal-metric) routes that can be defined per interface is three. You cannot add a route with the same metric on different interfaces that are on the same network.

Tunneled

Select this option to make this a tunnel route; can be used only for a default route. You can configure only one default tunneled gateway per device. The Tunneled option is not supported in transparent mode. Available only on PIX/ASA 7.0+ devices.

Route Tracking

To monitor route availability, enter or Select name of an SLA (service level agreement) object that defines the monitoring policy. Available only on PIX/ASA 7.2+ devices.

For more information on route tracking, see Monitoring Service Level Agreements (SLAs) To Maintain Connectivity.

Interface

Enter or Select the interface to which this static route applies.

IPv6 Network

Enter or Select the destination network(s). You can provide one or more IP address entries, one or more Networks/Hosts objects, or a combination of both; separate the entries with commas.

Enter two colons (::) to specify a default route.

IPv6 Gateway

Enter or Select the gateway router which is the next hop for this route. You can provide an IP address, or a Networks/Hosts object.

Note If an IP address from one of the security appliance’s interfaces is used as the Gateway IP address, the security appliance will resolve the designated IP address in the packet instead of resolving the Gateway IP address.

Metric

The Metric is a measurement of the “expense” of a route, based on the number of hops (hop count) to the network on which a specific host resides. Hop count is the number of networks that a network packet must traverse, including the destination network, before it reaches its final destination. Because the hop count includes the destination network, all directly connected networks have a metric of 1.

Enter the number of hops to the destination network. Valid values range from 1 to 255; the default value is 1.

The maximum number of equal-cost (equal-metric) routes that can be defined per interface is three. You cannot add a route with the same metric on different interfaces that are on the same network.

Tunneled

Select this option to specify the route as the default tunnel gateway for VPN traffic. You can configure only one default tunneled gateway per device. Available only on ASA 7.0+ devices in routed mode.