Configure Route Leaking Between Global and VRF Routing with PBR


Interface to Internet

interface Ethernet0/0
description Outside
ip vrf forwarding INTERNET
ip address

Interface Inside in the GRT (Global Routing Table)

interface Ethernet0/1
description Inside
ip address

Leaking default route to internet

ip route Ethernet0/0

NAT configuration

ip nat inside source list NAT interface Ethernet0/0 overload
access-list NAT permit

PBR configuration

ip prefix-list PREF seq 5 permit
route-map PBR permit 10
  match ip address 101
  set global
access-list 101 permit ip any

interface Ethernet0/0
 ip policy route-map PBR


Router#sh ip nat translations
Pro Inside global Inside local Outside local Outside global

Router#sh ip policy
Interface      Route map
Ethernet0/0    PBR

Router#sh route-map
route-map PBR, permit, sequence 10
  Match clauses:
    ip address (access-lists): 101
  Set clauses:
  Policy routing matches: 25 packets, 2850 bytes




BGP multipath with RR

The idea is to receive more than one path – i.e the best path calculate by the RR)

All routers are connected to the RR.

Extract of the configuration on the RR

router bgp 65000
bgp router-id
bgp log-neighbor-changes
bgp additional-paths select best 2
bgp additional-paths send
neighbor IBGP peer-group
neighbor IBGP remote-as 65000
neighbor IBGP update-source Loopback0
neighbor IBGP route-reflector-client
neighbor IBGP advertise additional-paths best 2
maximum-paths ibgp 2

The RR accepts two paths, and advertise additional paths on the same session.

Extract on one bgp client

router bgp 65000
bgp router-id
bgp log-neighbor-changes
neighbor remote-as 65000
neighbor update-source Loopback0
neighbor next-hop-self
neighbor additional-paths receive
maximum-paths ibgp 2

The client supports two paths and could receive more than one path from the same neighbor.

More information:

OSPF Router-ID lookup

By default ospf display Router-ID like IP address.

It’s possible to change this behavior and replace by a name.


R1#sh ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface 0 FULL/ - 00:00:39 Ethernet0/1 0 FULL/ - 00:00:36 Ethernet0/2


ip host R3
ip host R2

ip ospf name-lookup

R1#sh ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
R2 0 FULL/ - 00:00:38 Ethernet0/1
R3 0 FULL/ - 00:00:36 Ethernet0/2

Of course, fix the router-id.





PPPoE configuration example with CHAP


interface Ethernet0/0
 no ip address
 ip virtual-reassembly in
 pppoe enable
 pppoe-client dial-pool-number 1

interface Dialer1
 ip address negotiated
 ip mtu 1492
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 dialer pool 1
 ppp chap hostname User1
 ppp chap password 0 Password1
 ppp ipcp route default     << To install default route


username User1 password 0 Password1
bba-group pppoe Group10
 virtual-template 10

interface Virtual-Template10
 ip unnumbered Loopback0
 ip mtu 1492
 peer default ip address pool Pool10
 ppp authentication chap

interface Ethernet0/2
 ip address
 pppoe enable group Group10

ip local pool Pool10


client#sh ip int brief
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 unassigned YES manual up up
Ethernet1/3 unassigned YES TFTP administratively down down
Dialer1 YES IPCP up up
NVI0 unassigned NO unset up up
Virtual-Access1 unassigned YES unset up up
server# sh ppp all
Interface/ID OPEN+ Nego* Fail- Stage Peer Address Peer Name
------------ --------------------- -------- --------------- --------------------
Vi2.1 LCP+ CHAP+ IPCP+ LocalT User1

server# sh subscriber session brief
Current Subscriber Information: Total sessions 1

Uniq ID Interface State Up-time Identifier
6 Vi2.1 authen 00:12:49 User1




Cisco ASA ssh issue

Tested in version 9.6(1)

~# ssh admin@x.x.x.x
Unable to negotiate with x.x.x.x port 22: no matching key exchange method fouer: diffie-hellman-group1-sha1

First method:

 # ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@x.x.x.x
admin@x.x.x.x's password:
Type help or '?' for a list of available commands.

Second method:

ASA1/act/pri(config)# ssh key-exchange group ?

configure mode commands/options:
 dh-group1-sha1 Diffie-Hellman group 2
 dh-group14-sha1 Diffie-Hellman group 14

ASA1/act/pri(config)# ssh key-exchange group dh-group14

ASA1/act/pri(config)# wr

Disconnect and reconnect:

# ssh admin@x.x.x.x
admin@x.x.x.x's password:
Type help or '?' for a list of available commands.
ASA1/act/pri> en