Configurar o DVTI com protocolos de roteamento dinâmico no firewall seguro

Atualizado:30 de março de 2023
ID do documento:220320

Linguagem imparcial

O conjunto de documentação deste produto faz o possível para usar uma linguagem imparcial. Para os fins deste conjunto de documentação, a imparcialidade é definida como uma linguagem que não implica em discriminação baseada em idade, deficiência, gênero, identidade racial, identidade étnica, orientação sexual, status socioeconômico e interseccionalidade. Pode haver exceções na documentação devido à linguagem codificada nas interfaces de usuário do software do produto, linguagem usada com base na documentação de RFP ou linguagem usada por um produto de terceiros referenciado. Saiba mais sobre como a Cisco está usando a linguagem inclusiva.

Sobre esta tradução

A Cisco traduziu este documento com a ajuda de tecnologias de tradução automática e humana para oferecer conteúdo de suporte aos seus usuários no seu próprio idioma, independentemente da localização. Observe que mesmo a melhor tradução automática não será tão precisa quanto as realizadas por um tradutor profissional. A Cisco Systems, Inc. não se responsabiliza pela precisão destas traduções e recomenda que o documento original em inglês (link fornecido) seja sempre consultado.

    Introdução

    Este documento descreve como configurar uma Dynamic Virtual Tunnel Interface (DVTI) no Secure Firewall 9.20.

    Pré-requisitos

    • Tenha um Cisco Secure Firewall com ASA 9.20 ou posterior com uma configuração básica de roteamento e suporte a IKEV2 que funcione como hub com uma interface de loopback para simular a rede local nas instalações de 192.168.9.0/24.
    • Tenha um Cisco Secure Firewall com ASA 9.20 ou posterior com configuração básica de roteamento e suporte IKEv2 para funcionar como spoke-1 com uma interface de loopback pré-configurada para simular uma rede remota de 192.168.7.0/24.

    Requisitos

    • Conhecimento geral de todos os protocolos de roteamento dinâmico descritos neste documento (OSPF, EIGRP e BGP).
    • Familiarize-se com a configuração CLI em dispositivos Cisco Secure Firewall.

    Componentes Utilizados

    As informações neste documento são baseadas nestas versões de software:

    • Cisco Secure Firewall com ASA 9.20 ou posterior.
    note-icon

    Observação: as informações neste documento foram criadas a partir dos dispositivos em um ambiente de laboratório específico. Todos os dispositivos utilizados neste documento foram iniciados com uma configuração (padrão) inicial. Se a rede estiver ativa, certifique-se de que você entenda o impacto potencial de qualquer comando.

    Informações de Apoio

    Interfaces de túnel virtual dinâmico

    O Dynamic Virtual Tunnel Interfaces (DVTI) pode fornecer conectividade altamente segura e escalável para redes virtuais privadas (VPN) de acesso remoto.

    Os DVTIs podem ser usados para a configuração de Hub e Spoke. Os túneis fornecem uma interface de acesso virtual separada sob demanda para cada sessão VPN. 

    1. O spoke inicia uma solicitação de troca IKE com o hub para uma conexão VPN.

    2. O hub autentica o spoke.

    3. O Cisco Secure Firewall Management Center atribui um modelo virtual dinâmico no hub.

    4. O molde virtual gera dinamicamente uma interface de acesso virtual no hub. Essa interface é exclusiva para a sessão VPN por spoke.

    5. O hub estabelece um túnel VTI dinâmico com o spoke que usa a interface de acesso virtual.

    6. O hub e o spoke trocam tráfego pelo túnel que usa protocolos de roteamento dinâmico (BGP/OSPF/EIGRP) ou com o recurso de redes protegidas (VTI de associação de segurança múltipla).

    7. Os VTIs dinâmicos funcionam como qualquer outra interface, de modo que você possa aplicar QoS, regras de firewall, protocolos de roteamento e outros recursos assim que o túnel estiver ativo. 

    8. Um único DVTI é criado no dispositivo HUB e em várias interfaces de túnel estático para vários locais remotos/spoke.

    Neste artigo, o BGP, o OSPF e o EIGRP podem ser testados em DVTI.

    note-icon

    Observação: o Cisco Secure Firewall adicionou suporte para DVTI na versão 7.3 e atualmente ele suporta apenas um único DVTI conforme a ID de bug Cisco CSCwe13781.

    Configurar

    Diagrama de Rede

    Topology

    Configurações

    Configuração do Cisco Secure Firewall Hub

    Configure a interface de origem do túnel físico.

    interface GigabitEthernet0/0
 nameif vlan2820
 security-level 100
 ip address 10.28.20.98 255.255.255.0

    Configure a política IkEv2.

    crypto ikev2 policy 1
 encryption aes-256 aes-192 aes
 integrity sha512 sha384 sha256 sha
 group 21 20 14
 prf sha256
 lifetime seconds 86400

    Configure a diretiva IPSEC e anexe-a a um novo perfil IPSEC.

    crypto ipsec ikev2 ipsec-proposal VPN-LAB
 protocol esp encryption aes-256 aes-192 aes
 protocol esp integrity sha-512 sha-256 sha-1

crypto ipsec profile VPN-LAB-PROFILE
 set ikev2 ipsec-proposal VPN-LAB
 set security-association lifetime seconds 1000

    Configure o molde virtual com o perfil IPSEC criado anteriormente e atribua-o a uma interface de loopback que forneça o endereço IP para o DVTI.

    note-icon

    Observação: o molde virtual é usado para configurar o DVTI para túneis sob demanda.

    interface Loopback200
 nameif DVTI-LOOPBACK
 ip address 172.16.17.1 255.255.255.255 

interface Virtual-Template1 type tunnel
 nameif DVTI-HUB
 ip unnumbered DVTI-LOOPBACK
 tunnel source interface vlan2820
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile FMC_IPSEC_PROFILE_2

    Crie uma interface de loopback secundária para simular o tráfego da rede OnPREM atrás do hub.

    note-icon

    Observação: ignore esta etapa se você tiver tráfego local atrás do hub.

    interface Loopback100
 nameif ON-PREM
 ip address 192.168.9.1 255.255.255.255

    Configure tunnel-group.

    note-icon

    Observação: a interface do conjunto de rota de comando envia o endereço IP DVTI como um endereço IP estático para o peer.

    tunnel-group 10.28.20.100 type ipsec-l2l
tunnel-group 10.28.20.100 ipsec-attributes
 virtual-template 1 
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
 ikev2 route set interface

    Habilite IKEv2 na interface que constrói o túnel.

    crypto ikev2 enable vlan2820

    Configuração spoke do Cisco Secure Firewall

    Configure a interface de origem do túnel físico.

    interface GigabitEthernet0/0
 nameif vlan2820
 security-level 100
 ip address 10.28.20.100 255.255.255.0

    Configure a política IKEv2.

    crypto ikev2 policy 1
 encryption aes-256 aes-192 aes
 integrity sha512 sha384 sha256 sha
 group 21 20 14
 prf sha256
 lifetime seconds 86400

    Configure a diretiva IPSEC e anexe-a a um novo perfil IPSEC.

    crypto ipsec ikev2 ipsec-proposal VPN-LAB
 protocol esp encryption aes-256 aes-192 aes
 protocol esp integrity sha-512 sha-256 sha-1
crypto ipsec profile VPN-LAB-PROFILE
 set ikev2 ipsec-proposal VPN-LAB
 set security-association lifetime seconds 1000

    Configure a interface de túnel virtual estático com o perfil IPSEC, criado anteriormente e atribua-o a uma interface de loopback que forneça o endereço IP não numerado.

    interface Loopback200
 nameif VTI-LOOPBACK
 ip address 172.16.17.2 255.255.255.255 

interface Tunnel2
 nameif SVTI-SPOKE-3
 ip unnumbered VTI-LOOPBACK
 tunnel source interface vlan2820
 tunnel destination 10.28.20.98
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile VPN-LAB-PROFILE

    Crie uma interface de loopback secundária para simular o tráfego da rede LAN-REMOTE-1 atrás do spoke.

    interface Loopback100
 nameif LAN-REMOTE-1
 ip address 192.168.7.1 255.255.255.255

    Configure tunnel-group.

    note-icon

    Observação: a interface do conjunto de rotas de comando envia o endereço IP SVTI como um endereço IP estático para o peer.

    tunnel-group 10.28.20.98 type ipsec-l2l
tunnel-group 10.28.20.98 ipsec-attributes
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
 ikev2 route set interface

    Ative IKEv2 na interface que pode construir o túnel.

    crypto ikev2 enable vlan2820

    Configurar o OSPF

    Configuração de hub

    note-icon

    Observação: o comando Redistribute connected subnets é usado para anunciar uma rede OnPREM aos spokes via OSPF. A redistribuição pode ser diferente conforme o projeto.

    router ospf 1
 router-id 172.16.17.1
 network 172.16.17.0 255.255.255.0 area 0
 log-adj-changes
 redistribute connected subnets

    Configuração do raio

    router ospf 1
 router-id 172.16.17.2
 network 172.16.17.0 255.255.255.0 area 0
 log-adj-changes
 redistribute connected subnets

    Verificar o OSPF

    Verificação de hub

    ASAV2-hub# show ospf 

 Routing Process "ospf 1" with ID 172.16.17.1
 Start time: 4d23h, Time elapsed: 3d04h
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 It is an autonomous system boundary router
 Redistributing External Routes from,
    connected, includes subnets in redistribution
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 5000 msecs
 Minimum hold time between two consecutive SPFs 10000 msecs
 Maximum wait time between two consecutive SPFs 10000 msecs
 Incremental-SPF disabled
 Minimum LSA interval 5 secs
 Minimum LSA arrival 1000 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 Number of external LSA 5. Checksum Sum 0x39716 
 Number of opaque AS LSA 0. Checksum Sum 0x0     
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0)
        Number of interfaces in this area is 3 (1 loopback)
        Area has no authentication
        SPF algorithm last executed 2d04h ago
        SPF algorithm executed 10 times
        Area ranges are
        Number of LSA 2. Checksum Sum 0x1c99f 
        Number of opaque link LSA 0. Checksum Sum 0x0     
        Number of DCbitless LSA 0
        Number of indication LSA 0
        Number of DoNotAge LSA 0
        Flood list length 0

ASAV2-hub# show ospf neighbor 
Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.17.2       0   FULL/  -        0:00:39     172.16.17.2     DVTI-HUB_va11

    A tabela de roteamento no hub agora mostra a rede LAN-REMOTE-1 via OSPF.

    ASAV2-hub# show route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

O E2     192.168.7.0 255.255.255.255
           [110/20] via 172.16.17.2, 2d04h, DVTI-HUB_va11

    Verificação de raio

    ASAv-spoke-2# show ospf 

 Routing Process "ospf 1" with ID 172.16.17.2
 Start time: 3w3d, Time elapsed: 3d04h
 Supports only single TOS(TOS0) routes
 Supports opaque LSA
 Supports Link-local Signaling (LLS)
 Supports area transit capability
 Event-log enabled, Maximum number of events: 1000, Mode: cyclic
 It is an autonomous system boundary router
 Redistributing External Routes from,
    connected, includes subnets in redistribution
 Router is not originating router-LSAs with maximum metric
 Initial SPF schedule delay 5000 msecs
 Minimum hold time between two consecutive SPFs 10000 msecs
 Maximum wait time between two consecutive SPFs 10000 msecs
 Incremental-SPF disabled
 Minimum LSA interval 5 secs
 Minimum LSA arrival 1000 msecs
 LSA group pacing timer 240 secs
 Interface flood pacing timer 33 msecs
 Retransmission pacing timer 66 msecs
 Number of external LSA 4. Checksum Sum 0x37bc8 
 Number of opaque AS LSA 0. Checksum Sum 0x0     
 Number of DCbitless external and opaque AS LSA 0
 Number of DoNotAge external and opaque AS LSA 0
 Number of areas in this router is 1. 1 normal 0 stub 0 nssa
 Number of areas transit capable is 0
 External flood list length 0
 IETF NSF helper support enabled
 Cisco NSF helper support enabled
 Reference bandwidth unit is 100 mbps
    Area BACKBONE(0)
        Number of interfaces in this area is 2 (1 loopback)
        Area has no authentication
        SPF algorithm last executed 2d04h ago
        SPF algorithm executed 1 times
        Area ranges are
        Number of LSA 2. Checksum Sum 0x1fe9a 
        Number of opaque link LSA 0. Checksum Sum 0x0     
        Number of DCbitless LSA 0
        Number of indication LSA 0
        Number of DoNotAge LSA 0
        Flood list length 0

ASAv-spoke-2#  show ospf neighbor 
Neighbor ID     Pri   State           Dead Time   Address         Interface
172.16.17.1       0   FULL/  -        0:00:34     172.16.17.1     SVTI-SPOKE-3

    A tabela de roteamento no spoke agora mostra a rede OnPREM via OSPF.

    ASAv-spoke-2# show route ospf

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

O E2     192.168.9.1 255.255.255.255 
           [110/20] via 172.16.17.1, 2d04h, SVTI-SPOKE-3

    Agora, o spoke LAN-REMOTE-1 pode acessar OnPREM.

    ASAv-spoke-2# ping LAN-REMOTE-1 192.168.9.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.9.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

ASAv-spoke-2# show crypto ipsec sa peer  10.28.20.98 | i cap|iden|spi
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      #pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
      #pkts decaps: 9, #pkts decrypt: 9, #pkts verify: 9
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      current outbound spi: 4BC1FF2C
      current inbound spi : FB455CB8
      spi: 0xFB455CB8 (4215626936)
      spi: 0x4BC1FF2C (1271004972)

     Agora o hub OnPREM pode acessar LAN-REMOTE-1.

    ASAV2-hub# ping ON-PREM  192.168.7.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.7.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

ASAV2-hub# show crypto ipsec sa peer 10.28.20.100
peer address: 10.28.20.100
interface: DVTI-HUB_va12
    Crypto map tag: DVTI-HUB_vtemplate_dyn_map, seq num: 1, local addr: 10.28.20.98

      Protected vrf (ivrf): Global
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      current_peer: 10.28.20.100


      #pkts encaps: 15, #pkts encrypt: 15, #pkts digest: 15
      #pkts decaps: 15, #pkts decrypt: 15, #pkts verify: 15
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 15, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #TFC rcvd: 0, #TFC sent: 0
      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
      #send errors: 0, #recv errors: 0

      local crypto endpt.: 10.28.20.98/500, remote crypto endpt.: 10.28.20.100/500
      path mtu 1500, ipsec overhead 94(44), media mtu 1500
      PMTU time remaining (sec): 0, DF policy: copy-df
      ICMP error validation: disabled, TFC packets: disabled

    Configurar o EIGRP

    Configuração do hub:

    ASAV2-hub# sh run router
router eigrp 10
 network 172.16.17.0 255.255.255.0
 redistribute connected

    Configuração do raio:

    ASAv-spoke-2# sh run router
router eigrp 10
 network 172.16.17.0 255.255.255.0
 redistribute connected

    Agora, o spoke LAN-REMOTE-1 pode acessar OnPREM.

    ASAv-spoke-2# ping LAN-REMOTE-1 192.168.9.1 rep 100                  
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.9.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/10 ms

ASAv-spoke-2# show crypto ipsec sa peer 10.28.20.98  | i cap|iden|spi
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      #pkts encaps: 102, #pkts encrypt: 102, #pkts digest: 102
      #pkts decaps: 102, #pkts decrypt: 102, #pkts verify: 102
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      current outbound spi: 3EED404C
      current inbound spi : 646D2C0C
      spi: 0x646D2C0C (1684876300)
      spi: 0x3EED404C (1055735884)

     Agora o hub OnPREM pode acessar LAN-REMOTE-1.

    ASAV2-hub# ping ON-PREM 192.168.7.1 rep 100
Type escape sequence to abort.
Sending 100, 100-byte ICMP Echos to 192.168.7.1, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (100/100), round-trip min/avg/max = 1/1/10 ms

ASAV2-hub# show crypto ipsec sa peer 10.28.20.100 | i cap|iden|spi
      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
      #pkts encaps: 208, #pkts encrypt: 208, #pkts digest: 208
      #pkts decaps: 208, #pkts decrypt: 208, #pkts verify: 208
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      current outbound spi: 646D2C0C
      current inbound spi : 3EED404C
      spi: 0x3EED404C (1055735884)
      spi: 0x646D2C0C (1684876300)

    Verificar o EIGRP

    Verificação de hub:

    ASAV2-hub# show eigrp neighbors 
EIGRP-IPv4 Neighbors for AS(10)
H   Address                 Interface       Hold Uptime   SRTT   RTO   Q  Seq
                                            (sec)         (ms)        Cnt Num
0   172.16.17.2             DVTI-HUB_va12    12  00:02:01 8      200  0     4

    A tabela de roteamento no hub agora mostra a rede LAN-REMOTE-1 via EIGRP.

    ASAV2-hub# show route eigrp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

D EX     192.168.7.1 255.255.255.255 
           [170/53760] via 172.16.17.2, 00:05:28, DVTI-HUB_va12

    Verificação do raio:

    ASAv-spoke-2# show eigrp neighbors 
EIGRP-IPv4 Neighbors for AS(10)
H   Address                 Interface       Hold Uptime   SRTT   RTO   Q  Seq
                                            (sec)         (ms)        Cnt Num
0   172.16.17.1             SVTI-SPOKE-3     12  00:07:05 34     204  0     3

    A tabela de roteamento no spoke agora mostra a rede OnPREM via EIGRP.

    ASAv-spoke-2# show route eigrp 

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

D EX     192.168.9.1 255.255.255.255 
           [170/53760] via 172.16.17.1, 00:07:43, SVTI-SPOKE-3

    Configurar BGP

    note-icon

    Observação: quando as interfaces VTI estáticas ou dinâmicas são combinadas com o eBGP, certifique-se de que o valor do salto TTL seja mais de um se você usar o BGP.

    Configuração do hub:

    router bgp 100
 bgp log-neighbor-changes
 bgp bestpath compare-routerid
 address-family ipv4 unicast
  neighbor 172.16.17.2 remote-as 200
  neighbor 172.16.17.2 ebgp-multihop 10
  neighbor 172.16.17.2 activate
  redistribute connected
  no auto-summary
  no synchronization
 exit-address-family

    Configuração do raio

    router bgp 200
 bgp log-neighbor-changes
 bgp bestpath compare-routerid
 address-family ipv4 unicast
  neighbor 172.16.17.1 remote-as 100
  neighbor 172.16.17.1 ebgp-multihop 10
  neighbor 172.16.17.1 activate
  redistribute connected
  no auto-summary
  no synchronization
 exit-address-family

    Verificar o BGP

    Verificação de hub:

    ASAV2-hub# show bgp neighbors 

BGP neighbor is 172.16.17.2,  context single_vf,  remote AS 200, external link
  BGP version 4, remote router ID 192.168.7.1
  BGP state = Established, up for 00:05:28
  Last read 00:00:01, last write 00:01:00, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable (disabled)
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
    Multisession Capability: 
  Message statistics:
    InQ depth is 0
    OutQ depth is 0
    
                   Sent       Rcvd
    Opens:         1          1         
    Notifications: 0          0         
    Updates:       2          2         
    Keepalives:    6          6         
    Route Refresh: 0          0         
    Total:         9          9         
  Default minimum time between advertisement runs is 30 seconds
              
 For address family: IPv4 Unicast
  Session: 172.16.17.2
  BGP table version 7, neighbor version 7/0
  Output queue size : 0
  Index 1
  1 update-group member
                           Sent       Rcvd
  Prefix activity:         ----       ----
    Prefixes Current:      3          3          (Consumes 240 bytes)
    Prefixes Total:        3          3         
    Implicit Withdraw:     0          0         
    Explicit Withdraw:     0          0         
    Used as bestpath:      n/a        2         
    Used as multipath:     n/a        0         

                                Outbound    Inbound
  Local Policy Denied Prefixes: --------    -------
    Bestpath from this peer:     2          n/a       
    Total:                       2          0         
  Number of NLRIs in the update sent: max 3, min 0

  Address tracking is enabled, the RIB does have a route to 172.16.17.2
  Connections established 1; dropped 0
  Last reset never
  External BGP neighbor may be up to 10 hops away.
  Transport(tcp) path-mtu-discovery is enabled
  Graceful-Restart is disabled

ASAV2-hub#  
ASAV2-hub#  sh run router
router bgp 100
 bgp log-neighbor-changes
 bgp bestpath compare-routerid
 address-family ipv4 unicast
  neighbor 172.16.17.2 remote-as 200
  neighbor 172.16.17.2 ebgp-multihop 10
  neighbor 172.16.17.2 activate
  redistribute connected
  no auto-summary
  no synchronization
 exit-address-family
!
ASAV2-hub# sh run all router
router bgp 100
 bgp log-neighbor-changes
 no bgp always-compare-med
 no bgp asnotation dot
 no bgp bestpath med
 bgp bestpath compare-routerid
 bgp default local-preference 100
 no bgp deterministic-med
 bgp enforce-first-as
 bgp maxas-limit 0
 bgp transport path-mtu-discovery
 timers bgp 60 180 0
 address-family ipv4 unicast
  bgp scan-time 60
  bgp nexthop trigger enable
  bgp nexthop trigger delay 5
  bgp aggregate-timer 30
  neighbor 172.16.17.2 remote-as 200
  neighbor 172.16.17.2 ebgp-multihop 10
  neighbor 172.16.17.2 activate
  no bgp redistribute-internal
  no bgp soft-reconfig-backup
  no bgp suppress-inactive
  redistribute connected
  distance bgp 20 200 200
  no auto-summary
  no synchronization
 exit-address-family
!

    A tabela de roteamento no hub agora mostra a rede LAN-REMOTE-1 via BGP.

    ASAV2-hub# show route bgp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

B        192.168.7.1 255.255.255.255 [20/0] via 172.16.17.2, 00:06:16

    Verificação do raio:

    ASAv-spoke-2# show bgp neighbors 

BGP neighbor is 172.16.17.1,  context single_vf,  remote AS 100, external link
  BGP version 4, remote router ID 192.168.9.1
  BGP state = Established, up for 00:06:59
  Last read 00:00:27, last write 00:00:20, hold time is 180, keepalive interval is 60 seconds
  Neighbor sessions:
    1 active, is not multisession capable (disabled)
  Neighbor capabilities:
    Route refresh: advertised and received(new)
    Four-octets ASN Capability: advertised and received
    Address family IPv4 Unicast: advertised and received
    Multisession Capability: 
  Message statistics:
    InQ depth is 0
    OutQ depth is 0
    
                   Sent       Rcvd
    Opens:         1          1         
    Notifications: 0          0         
    Updates:       2          2         
    Keepalives:    7          8         
    Route Refresh: 0          0         
    Total:         10         11        
  Default minimum time between advertisement runs is 30 seconds
              
 For address family: IPv4 Unicast
  Session: 172.16.17.1
  BGP table version 9, neighbor version 9/0
  Output queue size : 0
  Index 1
  1 update-group member
                           Sent       Rcvd
  Prefix activity:         ----       ----
    Prefixes Current:      3          3          (Consumes 240 bytes)
    Prefixes Total:        3          3         
    Implicit Withdraw:     0          0         
    Explicit Withdraw:     0          0         
    Used as bestpath:      n/a        2         
    Used as multipath:     n/a        0         

                                Outbound    Inbound
  Local Policy Denied Prefixes: --------    -------
    Bestpath from this peer:     3          n/a       
    Total:                       3          0         
  Number of NLRIs in the update sent: max 3, min 0

  Address tracking is enabled, the RIB does have a route to 172.16.17.1
  Connections established 1; dropped 0
  Last reset never
  External BGP neighbor may be up to 10 hops away.
  Transport(tcp) path-mtu-discovery is enabled
  Graceful-Restart is disabled

    A tabela de roteamento no spoke agora mostra a rede OnPREM via BGP.

    ASAv-spoke-2#   show route bgp

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
       SI - Static InterVRF, BI - BGP InterVRF
Gateway of last resort is 10.28.20.101 to network 0.0.0.0

B        192.168.9.1 255.255.255.255 [20/0] via 172.16.17.1, 00:09:22

    Troubleshooting

    Para solucionar problemas do OSPF, use estes comandos debug e show:

      debug ip ospf 
  debug ip ospf packet 
  debug ip ospf events 
  debug ip ospf hello 
  debug ip ospf adj 

  show ospf 
  show ospf neighbor 
  show ospf interface

    Para solucionar problemas do EIGRP, use estes comandos debug e show:

      debug ip eigrp 
  debug ip eigrp neighbor 
  debug ip eigrp notifications 
    
  show eigrp 
  show eigrp 
    
    
      show eigrp interfaces show eigrp neighbors show eigrp topology

    Para solucionar problemas do BGP, use estes comandos de depuração e show:.

      debug ip bgp all 
  debug ip bgp updates 
  debug ip bgp events 
  
  show bgp 
  show bgp summary 
  show bgp neighbors

    Para solucionar problemas do IKEv2, use estes comandos debug e show:

      debug crypto ikev2 protocol 255
  debug crypto ikev2 platform 255
  debug crypto ipsec 255

    Informações Relacionadas

    Histórico de revisões

    Revisão Data de publicação Comentários
    1.0
    31-Mar-2023
    Versão inicial
    TAC Authored

    Colaborado por engenheiros da Cisco

    • Alan Omar Garcia Marchan
      Engenheiro HTTS da Cisco

    Este documento lhe foi útil?

    FeedbackFeedback

    Contate a Cisco

    Este documento se refere a estes produtos