ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.2

Permit and Deny Clauses

Route maps can have permit and deny clauses. In the route-map ospf-to-eigrp command, there is one deny clause (with sequence number 10) and two permit clauses. The deny clause rejects route matches from redistribution. Therefore, the following rules apply:

• If you use an ACL in a route map using a permit clause, routes that are permitted by the ACL are redistributed.
• If you use an ACL in a route map deny clause, routes that are permitted by the ACL are not redistributed.
• If you use an ACL in a route map permit or deny clause, and the ACL denies a route, then the route map clause match is not found and the next route-map clause is evaluated.

Match and Set Clause Values

Each route map clause has two types of values:

• A match value selects routes to which this clause should be applied.
• A set value modifies information that will be redistributed into the target protocol.

For each route that is being redistributed, the router first evaluates the match criteria of a clause in the route map. If the match criteria succeed, then the route is redistributed or rejected as dictated by the permit or deny clause, and some of its attributes might be modified by the values set from the Set Value tab in ASDM or from the set commands. If the match criteria fail, then this clause is not applicable to the route, and the software proceeds to evaluate the route against the next clause in the route map. Scanning of the route map continues until a clause is found whose match command(s), or Match Clause as set from the Match Clause tab in ASDM, match the route or until the end of the route map is reached.

A match or set value in each clause can be missed or repeated several times, if one of these conditions exists:

• If several match commands or Match Clause values in ASDM are present in a clause, all must succeed for a given route in order for that route to match the clause (in other words, the logical AND algorithm is applied for multiple match commands).
• If a match command or Match Clause value in ASDM refers to several objects in one command, either of them should match (the logical OR algorithm is applied). For example, in the match ip address 101 121 command, a route is permitted if ACL 101 or ACL 121 permits it.
• If a match command or Match Clause value in ASDM is not present, all routes match the clause. In the previous example, all routes that reach clause 30 match; therefore, the end of the route map is never reached.
• If a set command, or Set Value in ASDM, is not present in a route map permit clause, then the route is redistributed without modification of its current attributes.

Note Do not configure a set command in a route map deny clause because the deny clause prohibits route redistribution—there is no information to modify.

A route map clause without a match or set command, or Match or Set Value as set on the Match or Set Value tab in ASDM, performs an action. An empty permit clause allows a redistribution of the remaining routes without modification. An empty deny clause does not allows a redistribution of other routes (this is the default action if a route map is completely scanned, but no explicit match is found).

BGP Match and BGP Set Clauses

In addition to the match and set values described above, BGP provides additional match and set capabilities to route maps.

The following new route-map match clauses are now supported with BGP:

• match as-path
• match community
• match policy-list
• match tag

The following new route-map set clauses are now supported with BGP:

• set as-path
• set automatic-tag
• set community
• set local-preference
• set origin
• set weight

For each BGP route that is being redistributed, the ASA first evaluates the BGP match criteria of a clause in the route map. If the BGP match criteria succeeds, then the route is redistributed or rejected as dictated by the permit or deny clause, and some of its attributes might be modified by the values set from the BGP Set Clause tab in ASDM or from the set commands. If the match criteria fail, then this clause is not applicable to the route, and the software proceeds to evaluate the route against the next clause in the route map. Scanning of the route map continues until a clause is found whose match command(s), as set from the BGP Match Clause tab in ASDM, match the route or until the end of the route map is reached.

Adding or Editing a Route Map

In ASDM, you can define a route map by adding, editing, or deleting a route map name, sequence number, or redistribution.

To add or edit a route map, perform the following steps:

Step 1 In ASDM, choose Configuration > Device Setup > Routing > Route Maps.

Step 2 Click Add.

The Add Route Map or Edit Route Map dialog box appears.

Step 3 Enter the route map name and sequence number. The route map name is the name that you assign to a particular route. The sequence number is the order in which you add or delete the route map entries into the ASA.

Note If you are editing an existing route map, the fields for Route Map name and sequence number are already filled in.

Step 4 To reject route matches from redistribution, click Deny. If you use an ACL in a route map Deny clause, routes that are permitted by the ACL are not redistributed. To allow route matches for redistribution. click Permit. If you use an ACL in a route map Permit clause, routes that are permitted by the ACL are redistributed.

In addition, if you use an ACL in a route map Permit or Deny clause, and the ACL denies a route, then the route map clause match is not found and the next route map clause is evaluated.

Step 5 Click the Match Clause tab to choose routes to which this clause should be applied, and set the following parameters:

• Check the Match first hop interface of route check box to enable or disable matching the first hop interface of a route or to match any routes with the specified next hop interface. If you specify more than one interface, then the route can match either interface.

– Enter the interface name in the Interface field, or click the ellipses to display the Browse Interface dialog box.

– Choose one or more interfaces, click Interface, then click OK.

– Check the Match Address check box to enable or disable the Match address of a route or match packet.

– Check the Match Next Hop check box to enable or disable the Match next hop address of a route.

– Check the Match Route Source check box to enable or disable the Match advertising source address of the route.

– Choose Access List to Prefix List from the drop-down list to match the IP address.

– According to the previous selection, click the ellipses to display the Browse Access List or Browse Prefix List dialog box.

– Choose the ACL or prefix list that you want.

• Check the Match metric of route check box to enable or disable matching the metric of a route.

– In the Metric Value field, type the metric values. You can enter multiple values, separated by commas. This setting allows you to match any routes that have a specified metric. The metric value can range from 0 to 4294967295.

• Check the Match Route Type check box to enable or disable matching of the route type. Valid route types are External1, External2, Internal, Local, NSSA-External1, and NSSA-External2. When enabled, you can choose more than one route type from the list.

Step 6 Click the Set Clause tab to modify the following information, which will be redistributed to the target protocol:

• Check the Set Metric Clause check box to enable or disable the metric value for the destination routing protocol, and type the value in the Value field.
• Check the Set Metric Type check box to enable or disable the type of metric for the destination routing protocol, and choose the metric type from the drop-down list.

Step 7 Click the BGP Match Clause tab to choose routes to which this clause should be applied, and set the following parameters:

• Check the Match AS path access lists check box to enable matching the BGP autonomous system path access list with the specified path access list. If you specify more than one path access list, then the route can match either path access list.
• Check the Match Community check box to enable matching the BGP community with the specified community. If you specify more than one community, then the route can match either community. Any route that does not match atleast one Match community will not be advertised for outbound route maps.

– Check the Match the specified community exactly check box to enable matching the BGP community exactly with the specified community.

• Check the Match Policy list check box to configure a route map to evaluate and process a BGP policy. If you specify more than one policy list, then the route can process either policy list.

Step 8 Click the BGP Set Clause tab to modify the following information, which will be redistributed to the BGP protocol:

• Check the Set AS Path check box to modify an autonomous system path for BGP routes.

– Check the Prepend AS path check box to prepend an arbitrary autonomous system path string to BGP routes. Usually the local AS number is prepended multiple times, increasing the autonomous system path length. If you specify more than one AS path number then the route can prepend either AS numbers.

– Check the Prepend Last AS to the AS Path check box to prepend the AS path with the last AS number. Enter a value for the AS number from 1 to 10.

– Check the Convert route tag into AS Path check box to convert the tag of a route into an autonomous system path.

• Check the Set Community check box to set the BGP communities attributes.

– Click Specify Community to enter a community number, if applicable. Valid values are from 1 to 4294967200, internet, no-advertise and no-export.

– Check Add to the existing communities to add the community to the already existing communities.

– Click None to remove the community attribute from the prefixes that pass the route map.

• Check the Set local preference check box to specify a preference value for the autonomous system path.
• Check the Set weight check box to specify the BGP weight for the routing table. Enter a value between 0 and 65535.
• Check the Set origin check box to specify the BGP origin code. Valid values are Local IGP and Incomplete.
• Check the Set next hop check box to specify the output address of packets that fulfill the match clause of a route map.

– Click Specify IP address to enter the IP address of the next hop to which packets are output. It need not be an adjacent router. If you specify more than one IP address then the packets can output at either IP address.

– Click Use peer address to set the next hop to be the BGP peer address.

Step 9 Click OK.

Defining a Route to Match a Specific Destination Address

To define a route to match a specified destination address, perform the following steps:

Step 1 In ASDM, choose Configuration > Device Setup > Routing > Route Maps.

Step 2 Click Add.

The Add Route Map dialog box appears. From this dialog box you can assign or choose the route map name, the sequence number and its redistribution access (that is, permit or deny). Route map entries are read in order. You can identify the order using the sequence number, or the ASA uses the order in which you add the entries.

Step 3 Click the Match Clause tab to choose routes to which this clause should be applied, and set the following parameters:

• Check the Match first hop interface of route check box to enable or disable matching the first hop interface of a route or to match any routes with the specified next hop interface. If you specify more than one interface, then the route can match either interface.

– Enter the interface name in the Interface field, or click the ellipses to display the Browse Interface dialog box.

– Choose the interface type (inside or outside), click Selected Interface, then click OK.

– Check the Match IP Address check box to enable or disable the Match address of a route or match packet.

– Check the Match Next Hop check box to enable or disable the Match next hop address of a route.

– Check the Match Route Source check box to enable or disable the Match advertising source address of the route.

– Choose Access List to Prefix List from the drop-down list to match the IP address.

– According to the previous selection, click the ellipses to display the Browse Access List or Browse Prefix List dialog box.

– Choose the ACL or prefix list that you want.

• Check the Match metric of route check box to enable or disable matching the metric of a route.

– In the Metric Value field, type the metric values. You can enter multiple values, separated by commas. This setting allows you to match any routes that have a specified metric. The metric value can range from 0 to 4294967295.

• Check the Match Route Type check box to enable or disable matching of the route type. Valid route types are External1, External2, Internal, Local, NSSA-External1, and NSSA-External2. When enabled, you can choose more than one route type from the list.

Configuring Prefix Rules

Note You must configure a prefix list before you may configure a prefix rule.

To configure prefix rules, perform the following steps:

Step 1 In ASDM, choose Configuration > Device Setup > Routing > Prefix Rules.

Step 2 Click Add and choose Add Prefix Rule.

The Add Prefix Rule dialog box appears. From this dialog box, you can add a sequence number, specify a prefix for the network, its redistribution access (that is, permit or deny) and the minimum and maximum prefix length.

Step 3 Enter an optional sequence number or accept the default value.

Step 4 Specify the prefix number in the format of IP address/mask length.

Step 5 Click the Permit or Deny radio button to indicate the redistribution access.

Step 6 Enter the optional minimum and maximum prefix lengths.

Step 7 Click OK when you are done.

The new or revised prefix rule appears in the list.

Step 8 Check the Enable Prefix list sequence numbering check box if you want to use automatically generated sequence numbers.

Step 9 Click Apply to save your changes.

Configuring Prefix Lists

ABR type 3 LSA filtering extends the capability of an ABR that is running OSPF to filter type 3 LSAs between different OSPF areas. Once a prefix list is configured, only the specified prefixes are sent from one OSPF area to another OSPF area. All other prefixes are restricted to their OSPF area. You can apply this type of area filtering to traffic going into or coming out of an OSPF area, or to both the incoming and outgoing traffic for that area.

When multiple entries of a prefix list match a given prefix, the entry with the lowest sequence number is used. For efficiency, you may want to put the most common matches or denials near the top of the list by manually assigning them a lower sequence number. By default, sequence numbers are automatically generated in increments of 5, beginning with 5.

To add prefix lists, perform the following steps:

Step 1 In ASDM, choose Configuration > Device Setup > Routing > Prefix Rules.

Step 2 Click Add and choose Add Prefix List.

The Add Prefix List dialog box appears.

Step 3 Enter the prefix name and description, then click OK.

Configuring the Metric Values for a Route Action

To configure the metric value for a route action, perform the following steps:

Step 1 In ASDM, choose Configuration > Device Setup > Routing > Route Maps.

Step 2 Click Add.

The Add Route Map or Edit Route Map dialog box appears. From this dialog box, you can assign or select the route map name, the sequence number and its redistribution access (that is, permit or deny). Route map entries are read in order. You can identify the order using the sequence number, or the ASA uses the order in which you add route map entries.

Step 3 Click the Set Clause tab to modify the following information, which will be redistributed to the target protocol:

• Check the Set Metric Clause check box to enable or disable the metric value for the destination routing protocol, and enter the value in the Value field.
• Check the Set Metric Type check box to enable or disable the type of metric for the destination routing protocol, and choose the metric type from the drop-down list.