Router ID

On a single device, choose Automatic or IP Address. (An address field appears when you choose IP Address.)

If you choose Automatic, the highest-level IP address on the security appliance is used as the router ID. To use a fixed router ID, choose IP Address and enter an IPv4 address in the Router ID field.

On a device cluster, choose Automatic or Cluster Pool. (An IPv4 Pool object ID field appears when you choose Cluster Pool.)

If you choose Cluster Pool, enter or Select the name of the IPv4 Pool object that is to supply the Router ID address. For more information, see Add or Edit IPv4 Pool Dialog Box.

Learned Route Map

Enter or Select the name of a route map object.

Scanning Interval

Enter a scanning interval (in seconds) for BGP routers for next-hop validation. Valid values are from 5 to 60 seconds. The default value is 60.

Routes and Synchronization

Generate Default Route

(Optional) Configures a BGP routing process to distribute a default route (network 0.0.0.0).

Summarize subnet routes into network-level routes

(Optional) Configures automatic summarization of subnet routes into network-level routes.

Advertise inactive routes

(Optional) Advertises routes that are not installed in the routing information base (RIB).

Synchronize between BGP and the Interior Gateway Protocol (IGP) system

Enables synchronization between BGP and your Interior Gateway Protocol (IGP) system. To enable the Cisco IOS software to advertise a network route without waiting for the IGP, deselect this option.

Usually, a BGP speaker does not advertise a route to an external neighbor unless that route is local or exists in the IGP. By default, synchronization between BGP and the IGP is turned off to allow the Cisco IOS software to advertise a network route without waiting for route validation from the IGP. This feature allows routers and access servers within an autonomous system to have the route before BGP makes it available to other autonomous systems. Use synchronization if routers in the autonomous system do not speak BGP.

Redistribute iBGP into an IGP

(Optional) Configures iBGP redistribution into an interior gateway protocol (IGP), such as IS-IS or OSPF.

Administrative Route Distances

External

Specifies the administrative distance for external BGP routes. Routes are external when learned from an external autonomous system. The range of values for this argument are from 1 to 255. The default value is 20.

Internal

Specifies administrative distance for internal BGP routes. Routes are internal when learned from peer in the local autonomous system. The range of values for this argument are from 1 to 255. The default value is 200.

Local

Specifies administrative distance for local BGP routes. Local routes are those networks listed with a network router configuration command, often as back doors, for the router or for the networks that is being redistributed from another process. The range of values for this argument are from 1 to 255. The default value is 200.

Next Hop

Enable address tracking

(Optional) Enables BGP next hop address tracking.

Delay Interval

Specify the delay interval between checks on updated next-hop routes installed in the routing table.

Forward packets over Multiple Paths

Number of Paths

(Optional) Specify the maximum number of external BGP routes that can be installed to the routing table.

IBGP Number of Paths

(Optional) Specify the maximum number of internal BGP routes that can be installed to the routing table.

Network

Enter an IP address, or enter or Select the desired Network/Hosts objects.

Attribute Map

(Optional) Enter or Select the route map used to set the attribute of the aggregate route.

Advertise Map

(Optional) Enter or Select the route map used to select the routes to create AS_SET origin communities.

Suppress Map

(Optional) Enter or Select the route map used to select the routes to be suppressed.

Generate AS Set Path Information

Enables generation of autonomous system set path information.

Filter all more-specific routes from updates

Filters all more-specific routes from updates.

ACL

Select an Access Control List that defines which networks are to be received and which are to be suppressed in routing updates.

Direction

Choose a direction from the Direction drop-down list. The direction will specify if the filter should be applied to inbound updates or outbound updates.

Protocol

Select the routing process for which you want to filter: None, BGP, Connected, EIGRP, OSPF, RIP, or Static.

AS Number

Shows the autonomous system number of the BGP routing process. This value is specified on the BGP page (see Configuring BGP).

Process ID

Enter the identifier for the routing process. Applies to EIGRP and OSPF routing protocols.

General

IP Address

Enter the BGP neighbor IP address. This IP address is added to the BGP neighbor table.

Remote AS

Enter the autonomous system to which the BGP neighbor belongs.

Enable Address Family

(Optional) Enables communication with the BGP neighbor.

Shutdown neighbor administratively

(Optional) Disable a neighbor or peer group.

Configure Graceful Restart per neighbor

(ASA 9.3.1+ only)

(Optional) Enables configuration of the Border Gateway Protocol (BGP) graceful restart capability for this neighbor. After selecting this option, you must use the Graceful Restart (Use in failover or spanned cluster mode) option to specify whether graceful restart should be enabled or disabled for this neighbor.

Graceful Restart (Use in failover or spanned cluster mode)

(ASA 9.3.1+ only)

(Optional) Enables the Border Gateway Protocol (BGP) graceful restart capability for this neighbor.

Description

(Optional) Enter a description for the BGP neighbor.

fall-over BFD

(Optional) Enables BFD support for fall-over for the BGP neighbor.

BFD-Hop

(Optional) Specify if there is a single IP hop or multiple IP hops between a BFD source and destination.

Filtering

Filter routes using an access list

(Optional) Enter or Select the appropriate incoming or outgoing access control list to distribute BGP neighbor information.

Filter routes using route map

(Optional) Enter or Select the appropriate incoming or outgoing route maps to apply a route map to incoming or outgoing routes.

Filter routes using a Prefix list

(Optional) Enter or Select the appropriate incoming or outgoing prefix list to distribute BGP neighbor information.

Filter routes using AS Path filter

(Optional) Enter or Select the appropriate incoming or outgoing AS path filter to distribute BGP neighbor information.

Limit the number of prefixes allowed from the neighbor

(Optional) Select to control the number of prefixes that can be received from a neighbor.

• Enter the maximum number of prefixes allowed from a specific neighbor in the Maximum Prefixes field.

• Enter the percentage (of maximum) at which the router starts to generate a warning message in the Threshold Level field. Valid values are integers between 1 and 100. The default value is 75.

• (Optional) Check the Control prefixes received from the peer check box to specify additional controls for the prefixes received from a peer. Do one of the following:

  • Select Terminate peering when prefix limit is exceeded to stop the BGP neighbor when the prefix limit is reached. Specify the interval after which the BGP neighbor will restart in the Restart interval field.

  • Select Give only warning message when prefix limit is exceeded to generate a log message when the maximum prefix limit is exceeded. Here, the BGP neighbor will not be terminated.

Routes

Advertisement Interval

Enter the minimum interval (in seconds) between the sending of BGP routing updates. Valid values are between 1 and 600.

Remove private AS numbers from outbound routing updates

(Optional) Excludes the private AS numbers from being advertised on outbound routes.

Generate Default route

(Optional) Select to allow the local router to send the default route 0.0.0.0 to a neighbor to use as a default route. Enter or Select the route map that allows the route 0.0.0.0 to be injected conditionally in the Route map field.

Conditionally Advertised Routes

(Optional) To add or edit conditionally advertised routes, click the Add Row (+)button, or select a row in the table and click the Edit Row(pencil)button.

In the Add/Edit Advertised Route dialog box, do the following:

• Click Select to open the Route Map Object Selector from which you can select a route map that will be advertised if the conditions of the exist map or the non-exist map are met. For more information about route maps, see Understanding Route Map Objects.

• Do one of the following:

  • Select Set Exist Map and choose a route map from the Route Map Object Selector. This route map will be compared with the routes in the BGP table, to determine whether or not the advertise map route is advertised.

  • Select Non-Exist Map and choose a route map from the Route Map Object Selector. This route map will be compared with the routes in the BGP table, to determine whether or not the advertise map route is advertised.

Timers

Set timers for the BGP peer

(Optional) Select to set the keepalive frequency, hold time and minimum hold time.

Keepalive Interval

Enter the frequency (in seconds) with which the ASA sends keepalive messages to the neighbor. Valid values are between 0 and 65535. The default value is 60 seconds.

Hold Time

Enter the interval (in seconds) after not receiving a keepalive message that the ASA declares a peer dead. Valid values are between 0 and 65535. The default value is 180 seconds.

Min Hold Time

(Optional) Enter the minimum interval (in seconds) after not receiving a keepalive message that the ASA declares a peer dead. Valid values are between 0 and 65535. The default value is 0 seconds.

Advanced

Enable Authentication

(Optional) Select to enable MD5 authentication on a TCP connection between two BGP peers.

• Choose an encryption type from the Enable Encryption drop-down list.

• Enter a password in the Password field. Reenter the password in the Confirm field.

The password is case-sensitive and can be up to 25 characters long when the service password-encryption command is enabled and up to 81 characters long when the service password-encryption command is not enabled. The first character cannot be a number. The string can contain any alphanumeric characters, including spaces.

Send Community attribute to this neighbor

(Optional) Specifies that communities attributes should be sent to the BGP neighbor.

Use ASA as next hop for neighbor

(Optional) Select to configure the router as the next-hop for a BGP speaking neighbor or peer group.

Disable connection verification

(Optional) Select to disable the connection verification process for eBGP peering sessions that are reachable by a single hop but are configured on a loopback interface or otherwise configured with a non-directly connected IP address.

This command is required only when the neighbor ebgp-multihop command is configured with a TTL value of 1. The address of the single-hop eBGP peer must be reachable. The neighbor update-source command must be configured to allow the BGP routing process to use the loopback interface for the peering session.

When deselected (default), a BGP routing process will verify the connection of single-hop eBGP peering session (TTL=254) to determine if the eBGP peer is directly connected to the same network segment by default. If the peer is not directly connected to same network segment, connection verification will prevent the peering session from being established.

Allow connections with neighbor that is not directly connected

Select to accept and attempt BGP connections to external peers residing on networks that are not directly connected.

(Optional) Enter the time-to-live in the TTL hops field. Valid values are between 1 and 255.

Limit number of TTL hops to neighbor

Select this option to secure a BGP peering session. Enter the maximum number of hops that separate eBGP peers in the TTL hops field. Valid values are between 1 and 254.

This feature provides a lightweight security mechanism to protect BGP peering sessions from CPU utilization-based attacks. These types of attacks are typically brute force Denial of Service (DoS) attacks that attempt to disable the network by flooding the network with IP packets that contain forged source and destination IP addresses in the packet headers.

This feature leverages designed behavior of IP packets by accepting only IP packets with a TTL count that is equal to or greater than the locally configured value. Accurately forging the TTL count in an IP packet is generally considered to be impossible. Accurately forging a packet to match the TTL count from a trusted peer is not possible without internal access to the source or destination network.

This feature should be configured on each participating router. It secures the BGP session in the incoming direction only and has no effect on outgoing IP packets or the remote router. When this feature is enabled, BGP will establish or maintain a session only if the TTL value in the IP packet header is equal to or greater than the TTL value configured for the peering session. This feature has no effect on the BGP peering session, and the peering session can still expire if keepalive packets are not received. If the TTL value in a received packet is less than the locally configured value, the packet is silently discarded and no Internet Control Message Protocol (ICMP) message is generated. This is designed behavior; a response to a forged packet is not necessary.

To maximize the effectiveness of this feature, the hop-count value should be strictly configured to match the number of hops between the local and external network. However, you should also take path variation into account when configuring this feature for a multihop peering session.

The following restrictions apply to the configuration of this command:

• This feature is not supported for internal BGP (iBGP) peers.

• The effectiveness of this feature is reduced in large-diameter multihop peerings. In the event of a CPU utilization-based attack against a BGP router that is configured for large-diameter peering, you may still need to shut down the affected peering sessions to handle the attack.

• This feature is not effective against attacks from a peer that has been compromised inside of your network. This restriction also includes peers that are on the network segment between the source and destination network.

Use TCP Path MTU Discovery

(Optional) Select to enable a TCP transport session for a BGP session.

TCP transport mode

Choose the TCP connection mode from the drop-down list. Options are Default, Active, or Passive.

Weight

(Optional) Enter a weight for the BGP neighbor connection.

BGP Version

Choose the BGP version that the ASA will accept from the drop-down list. The version can be set to 4-Only to force the software to use only Version 4 with the specified neighbor. The default is to use Version 4 and dynamically negotiate down to Version 2 if requested.

Migration

Customize the AS number for routes received from the neighbor

(Optional) Select to customize the AS_PATH attribute for routes received from an eBGP neighbor.

Local AS Number

Enter the local autonomous system number. Valid values are any valid autonomous system number from 1 to 4294967295 or 1.0 to 65535.65535.

Do not prepend local AS number to routes received from neighbor

(Optional) Select to prevent the local AS number from being prepended to any routes received from eBGP peer.

Replace real AS number with local AS number in routes received from neighbor

(Optional) Select to replace the real autonomous system number with the local autonomous system number in the eBGP updates. The autonomous system number from the local BGP routing process is not prepended.

Accept either real AS number or local AS number in routes received from neighbor

(Optional) Configures the eBGP neighbor to establish a peering session using the real autonomous system number (from the local BGP routing process) or by using the local autonomous system number.

Network

Specifies the network to be advertised by the BGP routing processes.

Route Map

(Optional) Enter or Select a route map that should be examined to filter the networks to be advertised. If not specified, all networks are redistributed.

Source Protocol

Choose the protocol from which you want to redistribute routes into the BGP domain from the Source Protocol drop-down list.

Process ID

Enter the identifier for the routing process. Applies to EIGRP and OSPF routing protocols.

Metric

(Optional) Enter a metric for the redistributed route.

Route Map

Enter or Select a route map that should be examined to filter the networks to be redistributed. If not specified, all networks are redistributed.

Match

The conditions used for redistributing routes from one routing protocol to another. The routes must match the selected condition to be redistributed. You can choose one or more of the following match conditions. These options are enabled only when OSPF is chosen as the Source Protocol.

• Internal

• External 1

• External 2

• NSSA External 1

• NSSA External 2

Inject Map

Enter or Select the route map that specifies the prefixes to inject into the local BGP routing table.

Exist Map

Enter or Select the route map containing the prefixes that the BGP speaker will track.

Injected routes will inherit the attributes of the aggregate route

Configures the injected route to inherit attributes of the aggregate route.

Scanning Interval

Enter a scanning interval (in seconds) for BGP routers for next-hop validation. Valid values are from 5 to 60 seconds. The default value is 60.

Routes and Synchronization

Generate Default Routes

(Optional) Configures a BGP routing process to distribute a default route (network 0.0.0.0).

Advertise inactive routes

(Optional) Advertises routes that are not installed in the routing information base (RIB).

Synchronize between BGP and the Interior Gateway Protocol (IGP) system

Enables synchronization between BGP and your Interior Gateway Protocol (IGP) system. To enable the Cisco IOS software to advertise a network route without waiting for the IGP, deselect this option.

Usually, a BGP speaker does not advertise a route to an external neighbor unless that route is local or exists in the IGP. By default, synchronization between BGP and the IGP is turned off to allow the Cisco IOS software to advertise a network route without waiting for route validation from the IGP. This feature allows routers and access servers within an autonomous system to have the route before BGP makes it available to other autonomous systems. Use synchronization if routers in the autonomous system do not speak BGP.

Redistribute iBGP into an IGP (use filtering to limit the number of prefixes that are redistributed)

(Optional) Configures iBGP redistribution into an interior gateway protocol (IGP), such as IS-IS or OSPF.

Administrative Route Distances

External

Specifies the administrative distance for external BGP routes. Routes are external when learned from an external autonomous system. The range of values for this argument are from 1 to 255. The default value is 20.

Internal

Specifies administrative distance for internal BGP routes. Routes are internal when learned from peer in the local autonomous system. The range of values for this argument are from 1 to 255. The default value is 200.

Local

Specifies administrative distance for local BGP routes. Local routes are those networks listed with a network router configuration command, often as back doors, for the router or for the networks that is being redistributed from another process. The range of values for this argument are from 1 to 255. The default value is 200.

Forward packets over Multiple Paths

Number of Paths

(Optional) Specify the maximum number of Border Gateway Protocol routes that can be installed in a routing table. The range of values are from 1 to 8. The default value is 1.

IBGP Number of Paths

(Optional) Specify the maximum number of parallel internal Border Gateway Protocol (iBGP) routes that can be installed in a routing table. The range of values are from 1 to 8. The default value is 1.

Network

Enter an IP address, or enter or Select the desired Network/Hosts objects.

Attribute Map

(Optional) Enter or Select the route map used to set the attribute of the aggregate route.

Advertise Map

(Optional) Enter or Select the route map used to select the routes to create AS_SET origin communities.

Suppress Map

(Optional) Enter or Select the route map used to select the routes to be suppressed.

Generate AS Set Path Information

Enables generation of autonomous system set path information.

Filter all more-specific routes from updates

Filters all more-specific routes from updates.

General

IP Address

Enter the BGP neighbor IP address. This IP address is added to the BGP neighbor table.

Remote AS

Enter the autonomous system to which the BGP neighbor belongs.

Enable Address Family

(Optional) Enables communication with the BGP neighbor.

Shutdown neighbor administratively

(Optional) Disable a neighbor or peer group.

Configure Graceful Restart per neighbor

(ASA 9.3.1+ only)

(Optional) Enables configuration of the Border Gateway Protocol (BGP) graceful restart capability for this neighbor. After selecting this option, you must use the Graceful Restart (Use in failover or spanned cluster mode) option to specify whether graceful restart should be enabled or disabled for this neighbor.

Graceful Restart (Use in failover or spanned cluster mode)

(ASA 9.3.1+ only)

(Optional) Enables the Border Gateway Protocol (BGP) graceful restart capability for this neighbor.

Description

(Optional) Enter a description for the BGP neighbor.

fall-over BFD

(Optional) Enables BFD support for fall-over for the BGP neighbor.

BFD-Hop

(Optional) Specify if there is a single IP hop or multiple IP hops between a BFD source and destination.

Filtering

Filter routes using an access list

(Optional) Enter or Select the appropriate incoming or outgoing access control list to distribute BGP neighbor information.

Filter routes using route map

(Optional) Enter or Select the appropriate incoming or outgoing route maps to apply a route map to incoming or outgoing routes.

Filter routes using a Prefix list

(Optional) Enter or Select the appropriate incoming or outgoing prefix list to distribute BGP neighbor information.

Filter routes using AS Path filter

(Optional) Enter or Select the appropriate incoming or outgoing AS path filter to distribute BGP neighbor information.

Limit the number of prefixes allowed from the neighbor

(Optional) Select to control the number of prefixes that can be received from a neighbor.

• Enter the maximum number of prefixes allowed from a specific neighbor in the Maximum Prefixes field.

• Enter the percentage (of maximum) at which the router starts to generate a warning message in the Threshold Level field. Valid values are integers between 1 and 100. The default value is 75.

• (Optional) Check the Control prefixes received from the peer check box to specify additional controls for the prefixes received from a peer. Do one of the following:

  • Select Terminate peering when prefix limit is exceeded to stop the BGP neighbor when the prefix limit is reached. Specify the interval after which the BGP neighbor will restart in the Restart interval field.

  • Select Give only warning message when prefix limit is exceeded to generate a log message when the maximum prefix limit is exceeded. Here, the BGP neighbor will not be terminated.

Routes

Advertisement Interval

Enter the minimum interval (in seconds) between the sending of BGP routing updates. Valid values are between 1 and 600.

Remove private AS numbers from outbound routing updates

(Optional) Excludes the private AS numbers from being advertised on outbound routes.

Generate Default route

(Optional) Select to allow the local router to send the default route 0.0.0.0 to a neighbor to use as a default route. Enter or Select the route map that allows the route 0.0.0.0 to be injected conditionally in the Route map field.

Conditionally Advertised Routes

(Optional) To add or edit conditionally advertised routes, click the Add Row (+)button, or select a row in the table and click the Edit Row(pencil)button.

In the Add/Edit Advertised Route dialog box, do the following:

• Click Select to open the Route Map Object Selector from which you can select a route map that will be advertised if the conditions of the exist map or the non-exist map are met. For more information about route maps, see Understanding Route Map Objects.

• Do one of the following:

  • Select Set Exist Map and choose a route map from the Route Map Object Selector. This route map will be compared with the routes in the BGP table, to determine whether or not the advertise map route is advertised.

  • Select Non-Exist Map and choose a route map from the Route Map Object Selector. This route map will be compared with the routes in the BGP table, to determine whether or not the advertise map route is advertised.

Timers

Set timers for the BGP peer

(Optional) Select to set the keepalive frequency, hold time and minimum hold time.

Keepalive Interval

Enter the frequency (in seconds) with which the ASA sends keepalive messages to the neighbor. Valid values are between 0 and 65535. The default value is 60 seconds.

Hold Time

Enter the interval (in seconds) after not receiving a keepalive message that the ASA declares a peer dead. Valid values are between 0 and 65535. The default value is 180 seconds.

Min Hold Time

(Optional) Enter the minimum interval (in seconds) after not receiving a keepalive message that the ASA declares a peer dead. Valid values are between 0 and 65535. The default value is 0 seconds.

Advanced

Enable Authentication

(Optional) Select to enable MD5 authentication on a TCP connection between two BGP peers.

• Choose an encryption type from the Enable Encryption drop-down list.

• Enter a password in the Password field. Reenter the password in the Confirm field.

The password is case-sensitive and can be up to 25 characters long when the service password-encryption command is enabled and up to 81 characters long when the service password-encryption command is not enabled. The first character cannot be a number. The string can contain any alphanumeric characters, including spaces.

Send Community attribute to this neighbor

(Optional) Specifies that communities attributes should be sent to the BGP neighbor.

Use ASA as next hop for neighbor

(Optional) Select to configure the router as the next-hop for a BGP speaking neighbor or peer group.

Disable connection verification

(Optional) Select to disable the connection verification process for eBGP peering sessions that are reachable by a single hop but are configured on a loopback interface or otherwise configured with a non-directly connected IP address.

This command is required only when the neighbor ebgp-multihop command is configured with a TTL value of 1. The address of the single-hop eBGP peer must be reachable. The neighbor update-source command must be configured to allow the BGP routing process to use the loopback interface for the peering session.

When deselected (default), a BGP routing process will verify the connection of single-hop eBGP peering session (TTL=254) to determine if the eBGP peer is directly connected to the same network segment by default. If the peer is not directly connected to same network segment, connection verification will prevent the peering session from being established.

Allow connections with neighbor that is not directly connected

Select to accept and attempt BGP connections to external peers residing on networks that are not directly connected.

(Optional) Enter the time-to-live in the TTL hops field. Valid values are between 1 and 255.

Limit number of TTL hops to neighbor

Select this option to secure a BGP peering session. Enter the maximum number of hops that separate eBGP peers in the TTL hops field. Valid values are between 1 and 254.

This feature provides a lightweight security mechanism to protect BGP peering sessions from CPU utilization-based attacks. These types of attacks are typically brute force Denial of Service (DoS) attacks that attempt to disable the network by flooding the network with IP packets that contain forged source and destination IP addresses in the packet headers.

This feature leverages designed behavior of IP packets by accepting only IP packets with a TTL count that is equal to or greater than the locally configured value. Accurately forging the TTL count in an IP packet is generally considered to be impossible. Accurately forging a packet to match the TTL count from a trusted peer is not possible without internal access to the source or destination network.

This feature should be configured on each participating router. It secures the BGP session in the incoming direction only and has no effect on outgoing IP packets or the remote router. When this feature is enabled, BGP will establish or maintain a session only if the TTL value in the IP packet header is equal to or greater than the TTL value configured for the peering session. This feature has no effect on the BGP peering session, and the peering session can still expire if keepalive packets are not received. If the TTL value in a received packet is less than the locally configured value, the packet is silently discarded and no Internet Control Message Protocol (ICMP) message is generated. This is designed behavior; a response to a forged packet is not necessary.

To maximize the effectiveness of this feature, the hop-count value should be strictly configured to match the number of hops between the local and external network. However, you should also take path variation into account when configuring this feature for a multihop peering session.

The following restrictions apply to the configuration of this command:

• This feature is not supported for internal BGP (iBGP) peers.

• The effectiveness of this feature is reduced in large-diameter multihop peerings. In the event of a CPU utilization-based attack against a BGP router that is configured for large-diameter peering, you may still need to shut down the affected peering sessions to handle the attack.

• This feature is not effective against attacks from a peer that has been compromised inside of your network. This restriction also includes peers that are on the network segment between the source and destination network.

Use TCP Path MTU Discovery

(Optional) Select to enable a TCP transport session for a BGP session.

TCP transport mode

Choose the TCP connection mode from the drop-down list. Options are Default, Active, or Passive.

Weight

(Optional) Enter a weight for the BGP neighbor connection.

BGP Version

Choose the BGP version that the ASA will accept from the drop-down list. The version can be set to 4-Only to force the software to use only Version 4 with the specified neighbor. The default is to use Version 4 and dynamically negotiate down to Version 2 if requested.

Migration

Customize the AS number for routes received from the neighbor

(Optional) Select to customize the AS_PATH attribute for routes received from an eBGP neighbor.

Local AS Number

Enter the local autonomous system number. Valid values are any valid autonomous system number from 1 to 4294967295 or 1.0 to 65535.65535.

Do not prepend local AS number to routes received from neighbor

(Optional) Select to prevent the local AS number from being prepended to any routes received from eBGP peer.

Replace real AS number with local AS number in routes received from neighbor

(Optional) Select to replace the real autonomous system number with the local autonomous system number in the eBGP updates. The autonomous system number from the local BGP routing process is not prepended.

Accept either real AS number or local AS number in routes received from neighbor

(Optional) Configures the eBGP neighbor to establish a peering session using the real autonomous system number (from the local BGP routing process) or by using the local autonomous system number.

Network

Specifies the network to be advertised by the BGP routing processes.

Route Map

(Optional) Enter or Select a route map that should be examined to filter the networks to be advertised. If not specified, all networks are redistributed.

Source Protocol

Choose the protocol from which you want to redistribute routes into the BGP domain from the Source Protocol drop-down list.

Process ID

Enter the identifier for the routing process. Applies to EIGRP and OSPF routing protocols.

Metric

(Optional) Enter a metric for the redistributed route.

Route Map

Enter or Select a route map that should be examined to filter the networks to be redistributed. If not specified, all networks are redistributed.

Match

The conditions used for redistributing routes from one routing protocol to another. The routes must match the selected condition to be redistributed. You can choose one or more of the following match conditions. These options are enabled only when OSPF is chosen as the Source Protocol.

• Internal

• External 1

• External 2

• NSSA External 1

• NSSA External 2

Inject Map

Enter or Select the route map that specifies the prefixes to inject into the local BGP routing table.

Exist Map

Enter or Select the route map containing the prefixes that the BGP speaker will track.

Injected routes will inherit the attributes of the aggregate route

Configures the injected route to inherit attributes of the aggregate route.

EIGRP Filter Direction

Specify the direction for the filter rule:

• Inbound—The rule filters default route information from incoming EIGRP routing updates.

• Outbound—The rule filters default route information from outgoing EIGRP routing updates.

Type

Specify the type of filter rule:

• (Optional) Interface—Specify the interface on which to apply the routing updates. Specifying an interface causes the access list to be applied only to routing updates for that interface. If no interface is specified, the access list will be applied to all updates.

• (Optional) Routing Protocol—For outbound EIGRP routing updates, select the routing protocol for which you want to filter: BGP, Connected, OSPF, RIP, or Static.

Routing Protocol ID—Enter the identifier for the routing process. Applies to BGP and OSPF routing protocols.

ACL

Select an Access Control List that defines which networks are to be received and which are to be suppressed in routing updates.

Interface

The interface through which the neighbor is available.

Neighbor

The IP address of the static neighbor.

Protocol

Select the source protocol from which the routes are being redistributed. You can choose one of the following options:

• BGP—Redistribute routes discovered by the BGP routing process to EIGRP.

• RIP—Redistributes routes discovered by the RIP routing process to EIGRP.

• Static—Redistributes static routes to the EIGRP routing process. Static routes that fall within the scope of a network statement are automatically redistributed into EIGRP; you do not need to define a redistribution rule for them.

• Connected—Redistributes connected routes (routes established automatically by virtue of having IP address enabled on the interface) to the EIGRP routing process. Connected routes that fall within the scope of a network statement are automatically redistributed into EIGRP; you do not need to define a redistribution rule for them.

• OSPF—Redistributes routes discovered by the OSPF routing process to EIGRP. If you choose this protocol, the Match options on this dialog box become visible. These options are not available when redistributing static, connected, RIP, or BGP routes.

Routing Process ID

The autonomous system (AS) number for the BGP or OSPF routing process.

Optional Metrics

You can define the following metrics for routes redistributed into the EIGRP routing process:

• Bandwidth—the minimum bandwidth of the route in kilobits per second. Valid values range from 1 to 4294967295.

• Delay Time—the route delay in tens of microseconds. Valid values range from 0 to 4294967295.

• Reliability—the likelihood of successful packet transmission expressed as a number 0 through 255. The value 255 indicates 100 percent reliability; 0 means no reliability.

• Loading—the effective bandwidth of the route. Valid values range from 1 to 255; 255 indicates 100 percent loaded.

• MTU—the smallest allowed value for the maximum transmission unit of the path. Valid values range from 1 to 65535.

Route Map

Enter or Select a route map object to define which routes are redistributed into the EIGRP routing process.

Optional OSPF Redistribution

If you have chosen OSPF as the Route Type, choose the conditions used for redistributing routes from one routing protocol to another. The routes must match the selected condition to be redistributed. You can choose one or more of the following match conditions:

• Internal—The route is internal to a specific AS.

• External 1—Routes that are external to the autonomous system, but are imported into OSPF as Type 1 external routes.

• External 2—Routes that are external to the autonomous system, but are imported into OSPF as Type 2 external routes.

• NSSA External 1—Routes that are external to the autonomous system, but are imported into OSPF as Type 2 NSSA routes.

• NSSA External 2—Routes that are external to the autonomous system, but are imported into OSPF as Type 2 NSSA routes.

Interface

The interface from which the summary address is advertised.

Networks

The IP address and network mask of the summary address.

Administrative Distance

(Optional) The administrative distance of the summary route. Valid values are from 1 to 255. The default value is 5.

Interface

The name of the interface to which the configuration applies.

Hello Interval

The interval, in seconds, between EIGRP hello packets sent on an interface. Valid values range from 1 to 65535 seconds. The default value is 5 seconds.

Hold Time

The hold time advertised by the ASA in EIGRP hello packets. Valid values range from 1 to 65535 seconds. The default value is 15 seconds.

Split Horizon

Enable/disable EIGRP split-horizon on an interface.

Delay Time

The delay time in tens of microseconds. Valid values are from 1 to 16777215. This option is not supported for devices in multi-context mode and will be disabled.

Enable MD5 Authentication

Enables MD5 authentication of EIGRP packets.

Key Type

Select Clear Text to indicate that the key you will be entering is in clear text. Select Encrypted to indicate that the key you will be entering is already encrypted.

Key ID and Key

Specify the key to authenticate EIGRP updates:

• Key ID—Enter a numerical key identifier. Valid values range from 0to 255.

• Key—An alphanumeric character string of up to 16 bytes.

• Confirm—Re-enter the key.

Perform Adjacency Check

Check the ‘Perform adjacency check’ check box for the router to check on nearby IS routers.

Distance

Administrative Distance

In the Administrative Distance field, enter a distance assigned to routes discovered by IS-IS protocol. Administrative distance is a parameter used to compare routes among different routing protocols. In general, the higher the value, the lower the trust rating. And administrative distance of 255 means that the routing information source cannot be trusted at all and should be ignored. The range is 1 to 255. The default is 115.

Maximum No. of Forward Paths

Enter the maximum number of IS routes that can be installed in a routing table. The range is 1 to 8, the default is 4.

Distribute Default Route

Check the Distribute default route check box to configure an IS routing process to distribute a default route, and then choose the default route from the Route Map Object selector.

ISIS Metrics

Global ISIS Metric Level 1

Enter a number specifying the metric.

The range depends on the TLV Style that you select. The default is 10.

• If you select Use old style of TLVs with narrow metric, the range is 1 to 63.

• If you select Use new style of TLVs to carry wider metric, the range is 1 to 16777214.

• If you select Send and accept both styles of TLVs during transition, the range is 1 to 16777214.

Global ISIS Metric Level 2

Enter a number specifying the metric.

The range depends on the TLV Style that you select. The default is 10.

• If you select Use old style of TLVs with narrow metric, the range is 1 to 63.

• If you select Use new style of TLVs to carry wider metric, the range is 1 to 16777214.

• If you select Send and accept both styles of TLVs during transition, the range is 1 to 16777214.

TLV Style

Select one of the following Type, Length, and Values:

• Use old style of TLVs with narrow metric

• Use new style of TLVs to carry wider metric

• Send and accept both styles of TLVs during transition

Accept both styles of TLVs during transition

If you selected one of the first two options in TLV Style, you can select this option,

Apply metric style to

Select one of the following:

• Level 1

• Level 2

• Both

The default is Level 1.

Shortest Path First

Honour external metrics during SPF calculations

Check this check box to have the SPF calculations include external metrics.

Signal other routers to not use this router as an intermediate hop in their SPF calculations

Check this check box if you want to exclude this device, and configure the following:

Specify on-startup behavior

If you select this element you must choose one of the following options:

• Advertise overself as overloaded until BGP has converged

• Specify time to advertise overself as overloaded after reboot—Specify the time in the range of 5 to 86400 seconds.

Don’t advertise IP prefixes learned from other protocols when overload bit is set

Check this check box to exclude IP prefixes.

Don’t advertise IP prefixes learned from another ISIS level when overload bit is set

Check this check box to exclude IP prefixes.

Minimum interval between partial route calculations

PRC Interval

Enter an amount of time for the router to wait between partial route calculations (PRCs). The range is 1 to 120 seconds. The default is 5 seconds.

Initial wait for PRC

Enter the initial PRC calculation delay (in milliseconds) after a topology change. The range is 1 to 120.000 milliseconds. The default is 2000 milliseconds.

Minimum wait between first and second PRC

Enter the amount of time in milliseconds that you want the router to wait between PRCs. The range is 1 to 120,000 milliseconds. The default is 5000 milliseconds.

Minimum interval between SPF calculations

Configure parameters for level 1

SPF calculation interval

Enter an amount of time for the router to wait between SPF calculations. The range is 1 to 120 seconds. The default is 10 seconds.

Initial wait for SPF calculation

Enter the amount of time for the router to wait for an SPF calculation. The range is 1 to 120.000 milliseconds. The default is 5500 milliseconds.

Minimum wait between first and second SPF calculation

Enter the amount of time in milliseconds that you want the router to wait between SPF calculations. The range is 1 to 120,000 milliseconds. The default is 5500 milliseconds.

Configure parameters for level 2

SPF calculation interval

Enter an amount of time for the router to wait between SPF calculations. The range is 1 to 120 seconds. The default is 10 seconds.

Initial wait for SPF calculation

Enter the amount of time for the router to wait for an SPF calculation. The range is 1 to 120.000 milliseconds. The default is 5500 milliseconds.

Minimum wait between first and second SPF calculation

Enter the amount of time in milliseconds that you want the router to wait between SPF calculations. The range is 1 to 120,000 milliseconds. The default is 5500 milliseconds.

Source Protocol

From the Source Protocol drop-down list, choose the protocol (BGP, Connected, EIGRP, OSPF, RIP, or Static) from which you want to redistribute routes into the ISIS domain.

Process ID

Enter the Process ID for the source protocol.

Route Level

From the Route Level drop-down list, choose Level-1, Level- 2, or Level 1-2.

Metric

In the Metric field, enter a metric for the redistributed route. The range is 1 to 4294967295.

Metric Type

For the Metric Type, click the internal or external radio button.

ISIS Inter Area Route Levels

Source ISIS Level

Select Level 1 or Level 2. The default is Level 1.

Destination ISIS Level

Select Level 1 or Level 2. The default is Level 1.

Distribution List

Select from the available Access Control List or add new.

Route Map

Choose a route map from the Route Map Object selector that should be examined to filter the networks to be redistributed, or click Add to add a new route map or edit an existing route map.

Match

Check one or more of the Match check boxes -Internal, External 1, External 2, NSSA External 1, and NSSA External 2 check boxes to redistribute routes from an OSPF network.

Perform Adjacency Check

Check the ‘Perform adjacency check’ check box for the router to check on nearby IS routers.

Distance

Administrative Distance

In the Administrative Distance field, enter a distance assigned to routes discovered by ISIS protocol. Administrative distance is a parameter used to compare routes among different routing protocols. In general, the higher the value, the lower the trust rating. And administrative distance of 255 means that the routing information source cannot be trusted at all and should be ignored. The range is 1 to 255. The default is 115.

Maximum No. of Forward Paths

Enter the maximum number of IS routes that can be installed in a routing table. The range is 1 to 8. The default is 4.

Distribute Default Route

Check the Distribute default route check box to configure an IS routing process to distribute a default route, and then choose the default route from the Route Map Object selector.

Shortest Path First

Signal other routers to not use this router as an intermediate hop in their SPF calculations

Check this check box if you want to exclude this device, and configure the following:

Specify on-startup behavior

If you select this element you must choose one of the following options:

• Advertise overself as overloaded until BGP has converged

• Specify time to advertise overself as overloaded after reboot—Specify the time in the range of 5 to 86400 seconds.

Don’t advertise IP prefixes learned from other protocols when overload bit is set

Check this check box to exclude IP prefixes.

Don’t advertise IP prefixes learned from another ISIS level when overload bit is set

Check this check box to exclude IP prefixes.

Minimum interval between partial route calculations

PRC Interval

Enter an amount of time for the router to wait between partial route calculations (PRCs). The range is 1 to 120 seconds. The default is 5 seconds.

Initial wait for PRC

Enter the initial PRC calculation delay (in milliseconds) after a topology change. The range is 1 to 120.000 milliseconds. The default is 2000 milliseconds.

Minimum wait between first and second PRC

Enter the amount of time in milliseconds that you want the router to wait between PRCs. The range is 1 to 120,000 milliseconds. The default is 5000 milliseconds.

Minimum interval between SPF calculations

Configure parameters for level 1

SPF calculation interval

Enter an amount of time for the router to wait between SPF calculations. The range is 1 to 120 seconds. The default is 10 seconds.

Initial wait for SPF calculation

Enter the amount of time for the router to wait for an SPF calculation. The range is 1 to 120.000 milliseconds. The default is 5500 milliseconds.

Minimum wait between first and second SPF calculation

Enter the amount of time in milliseconds that you want the router to wait between SPF calculations. The range is 1 to 120,000 milliseconds. The default is 5500 milliseconds.

Configure parameters for level 2

SPF calculation interval

Enter an amount of time for the router to wait between SPF calculations. The range is 1 to 120 seconds. The default is 10 seconds.

Initial wait for SPF calculation

Enter the amount of time for the router to wait for an SPF calculation. The range is 1 to 120.000 milliseconds. The default is 5500 milliseconds.

Minimum wait between first and second SPF calculation

Enter the amount of time in milliseconds that you want the router to wait between SPF calculations. The range is 1 to 120,000 milliseconds. The default is 5500 milliseconds.

Source Protocol

From the Source Protocol drop-down list, choose the protocol (BGP, Connected, EIGRP, OSPF, RIP, or Static) from which you want to redistribute routes into the ISIS domain.

Process ID

Enter the Process ID for the source protocol.

Route Level

From the Route Level drop-down list, choose Level-1, Level- 2, or Level 1-2.

Metric

In the Metric field, enter a metric for the redistributed route. The range is 1 to 4294967295.

Metric Type

For the Metric Type, click the internal or external radio button.

ISIS Inter Area Route Levels

Source ISIS Level

Select Level 1 or Level 2. The default is Level 1.

Destination ISIS Level

Select Level 1 or Level 2. The default is Level 1.

Distribution List

Select from the available Access Control List or add new.

Route Map

Choose a route map from the Route Map Object selector that should be examined to filter the networks to be redistributed, or click Add to add a new route map or edit an existing route map.

Match

Check one or more of the Match check boxes -Internal, External 1, External 2, NSSA External 1, and NSSA External 2 check boxes to redistribute routes from an OSPF network.

IPv6 Summary Prefix

IPv6 prefix in the form X.X.X.X.::X/0-128

Apply Summary Prefix into

Select Level 1, Level 2, or Both.

Level 1: Only routes redistributed into Level 1 are summarized with the configured address and mask value.

Level 2: Routes learned by Level 1 routing are summarized into the Level 2 backbone with the configured address and mask value. Redistributed routes into Level 2 ISIS are also summarized.

Both: Summary routes are applied when redistributing routes into Level 1 and Level2 ISIS and when Level 2 ISIS advertises Level 1 routes as reachable in it area.

Interface

Select the interface from available interfaces.

Shutdown ISIS on this interface

Shutdown ISIS on this interface—Lets you disable the IS-IS protocol for this interface without removing the configuration parameters. The IS-IS protocol will not form any adjacencies on this interface and the IP address of this interface will be put into the LSP that is generated by the ASA.

Enable ISIS on this interface

Enables IS-IS protocol on the selected interface.

Enable IPv6 ISIS on this interface

Enables IPv6 IS-IS routing on the selected interface.

Priority for level 1

Lets you set a priority for Level 1. The priority is used to determine which router on a LAN will be the designated router or Designated Intermediate System (DIS). The priorities are advertised in the hello packets. The router with the highest priority becomes the DIS. The range is 0 to 127. The default is 64.

Priority for level 2

Lets you set a priority for Level 2. The priority is used to determine which router on a LAN will be the designated router or Designated Intermediate System (DIS). The priorities are advertised in the hello packets. The router with the highest priority becomes the DIS. The range is 0 to 127. The default is 64.

Tag

Sets a tag on the IP address configured for an interface when this IP prefix is put into an ISIS LSP.

CSNP Interval for level 1

Sets the Complete Sequence Number PDUs (CSNPs) interval in seconds between transmission of CSNPs on multiaccess networks for Level 1. This interval only applies for the designated router. The range is from 0 to 65535. The default is 10 seconds.

CSNP Interval for level 2

Sets the Complete Sequence Number PDUs (CSNPs) interval in seconds between transmission of CSNPs on multiaccess networks for Level 2. This interval only applies for the designated router. The range is from 0 to 65535. The default is 10 seconds.

Adjacency filter

Filters the establishment of IS-IS adjacencies.

Match all area addresses

All NSAP addresses must match the filter to accept the adjacency.

If not specified (the default), only one address must match the filter for the adjacency to be accepted.

Level 1 parameters

Key Type

Select Clear Text or Encrypted.

Key

Enter the key to authenticate IS-IS updates. The range is 0 to 8 characters.

If no password is configured with the Key option, no key authentication is performed.

Send only

For Send only click the Enable or Disable radio button.

Choosing Send only causes the system only to insert the password into the SNPs, but not check the password in SNPs that it receives. Use this keyword during a software upgrade to ease the transition. The default is disabled.

Mode

Choose the authentication mode by checking the Mode check box and then choosing MD5 or Text from the drop-down list.

Password

Enter a password.

Level 2 parameters

Key Type

Select Clear Text or Encrypted.

Key

Enter the key to authenticate IS-IS updates. The range is 0 to 8 characters.

If no password is configured with the Key option, no key authentication is performed.

Send only

For Send only click the Enable or Disable radio button.

Choosing Send only causes the system only to insert the password into the SNPs, but not check the password in SNPs that it receives. Use this keyword during a software upgrade to ease the transition. The default is disabled.

Mode

Choose the authentication mode by checking the Mode check box and then choosing MD5 or Text from the drop-down list.

Password

Enter a password.

Hello Padding

Enables Hello Padding.

IS-IS hellos are padded to the full maximum transmission unit (MTU) size. Padding IS-IS hellos to the full MTU allows for early detection of errors that result from transmission problems with large frames or errors that result from mismatched MTUs on adjacent interfaces.

Minimal holdtime 1 second for level 1

Enables the holdtime (in seconds) that the LSP remains valid for Level 1.

Hello interval for level 1

Specifies the length of time in seconds between hello packets for Level 1. The range is 1 to 65535. The default is 10.

Minimal holdtime 1 second for level 2

Enables the holdtime (in seconds) that the LSP remains valid for Level 2.

Hello interval for level 2

Specifies the length of time in seconds between hello packets for Level 2. The range is 1 to 65535. The default is 10.

Hello multiplier for level 1

Specifies the number of IS-IS hello packets a neighbor must miss before the ASA declares the adjacency is down for Level 1.

The advertised hold time in IS-IS hello packets will be set to the hello multiplier times the hello interval. Neighbors will declare an adjacency to this router down after not having received any IS-IS hello packets during the advertised hold time. The hold time (and thus the hello multiplier and the hello interval) can be set on a per-interface basis, and can be different between different routers in one area. The range is 3 to 1000. The default is 3.

Hello multiplier for level 2

Specifies the number of IS-IS hello packets a neighbor must miss before the ASA declares the adjacency is down for Level 2.

The advertised hold time in IS-IS hello packets will be set to the hello multiplier times the hello interval. Neighbors will declare an adjacency to this router down after not having received any IS-IS hello packets during the advertised hold time. The hold time (and thus the hello multiplier and the hello interval) can be set on a per-interface basis, and can be different between different routers in one area. The range is 3 to 1000. The default is 3.

Configure Circuit Type

Specifies whether the interface is configured for local routing (level 1), area routing (Level 2), or both local and area routing (Level 1-2).

Advertise ISIS Prefix

Allows the advertising of IP prefixes of connected networks in the LSP advertisements per IS-IS interface.

Disabling this option is an IS-IS mechanism to exclude IP prefixed of connected network from LSP advertisements thereby reducing IS-IS convergence time.

Retransmit Interval

Specifies the amount of time in seconds between retransmission of each IS-IS LSP on a point-to-point link.

The number should be greater than the expected round-trip delay between any two routers on the attached network. The range is 0 to 65535. The default is 5.

Retransmit Throttle Interval

Specifies the amount of time in milliseconds between retransmissions on each IS-IS LSP on a point-to-point interface.

This option may be useful in very large networks with many LSPs and many interfaces as a way of controlling LSP retransmission traffic. This option controls the rate at which LSPs can be re-sent on the interface. The range is 0 to 65535. The default is 33.

LSP Interval

Specifies the time delay in millisecond between successive IS-IS LSP transmissions.

In topologies with a large number of IS-IS neighbors and interfaces, a router may have difficulty with the CPU load imposed by LSP transmission and reception. This option allows the LSP transmission rate (and by implication the reception rate of other systems) to be reduced. The range is 1 to 4294967295. The default is 33.

Metrics for level 1

Use maximum metric value

Specifies the metric assigned to the link and used to calculate the cost from each other router via the links in the network to other destinations. This is enabled by default.

Default metric

Enter the number for the metric. The range is 1 to 16777214.

Metrics for level 2

Use maximum metric value

Specifies the metric assigned to the link and used to calculate the cost from each other router via the links in the network to other destinations. This is enabled by default.

Default metric

Enter the number for the metric. The range is 1 to 16777214.

OSPF Process

Displays the ID of the OSPF process you are configuring. You cannot change this value in this dialog box.

General Tab

Router ID

To use a fixed router ID, select IP Address and then enter a router ID in IP address format in the Router ID field. To have the router ID automatically generated (the highest-level IP address on the security appliance is used as the router ID), select Automatic.

Ignore LSA MOSPF

Select this option to suppress transmission of syslog messages when the security appliance receives Type 6 (MOSPF) LSA packets.

RFC 1583 Compatible

Select this option to calculate summary route costs per RFC 1583. Deselect this option to calculate summary route costs per RFC 2328. To minimize the chance of routing loops, all OSPF devices in an OSPF routing domain should have RFC compatibility set identically. This option is selected by default.

Adjacency Changes

These options specify the syslog messages sent when adjacency changes occur.

• Log Adjacency Changes – When selected, the security appliance sends a syslog message whenever an OSPF neighbor goes up or down. This option is selected by default.

• Log Adjacency Changes Detail – When selected, the security appliance sends a syslog message whenever any state change occurs, not just when a neighbor goes up or down. This option is not selected by default.

Administrative Route Distances

Settings for the administrative route distances, according to the route type.

• Inter Area – The administrative distance for all routes from one area to another. Valid values range from 1 to 255; the default value is 110.

• Intra Area – The administrative distance for all routes within an area. Valid values range from 1 to 255; the default value is 110.

• External – The administrative distance for all routes from other routing domains that are learned through redistribution. Valid values range from 1 to 255; the default value is 110.

Timers

Settings used to configure LSA arrival, LSA pacing, and throttling for ASA 9.2(1)+ devices:

• LSA Arrival – The minimum delay in milliseconds that must pass between acceptance of the same LSA arriving from neighbors. The range is from 0 to 600,000 milliseconds. The default is 1000 milliseconds.

• LSA Flood Pacing – The time in milliseconds at which LSAs in the flooding queue are paced in between updates. The configurable range is from 5 to 100 milliseconds. The default value is 33 milliseconds.

• LSA Group Pacing – The interval at which LSAs are collected into a group and refreshed, checksummed, or aged. Valid values range from 10 to 1800; the default value is 240 seconds.

• LSA Retransmission Pacing - The time in milliseconds at which LSAs in the retransmission queue are paced. The configurable range is from 5 to 200 milliseconds. The default value is 66 milliseconds.

• LSA Throttle – The delay in milliseconds to generate the first occurrence of the LSA. Valid values range from 0 to 600000 milliseconds. When you enter a value in this field, the Min and Max fields are enabled:

  • Min – The minimum delay for originating the same LSA. Valid values range from 1 to 600000 milliseconds.

  • Max – The maximum delay for originating the same LSA. Valid values range from 1 to 600000 milliseconds.

• SPF Throttle – The delay to receive a change to the SPF calculation. Valid values range from 1 to 600000 milliseconds. When you enter a value in this field, the Min and Max fields are enabled:

  • Min – The delay between the first and second SPF calculations. Valid values range from 1 to 600000 milliseconds.

  • Max – The maximum wait time for SPF calculations. Valid values range from 1 to 600000 milliseconds.

Settings used to configure LSA pacing and SPF calculation timers for device versions earlier than 9.2(1):

• SPF Delay – The time between receipt of a topology change and the start of shortest path first (SPF) calculations. Valid values range from 0 to 65535; the default value is 5 seconds.

• SPF Hold – The hold time between consecutive SPF calculations. Valid values range from 1 to 65534; the default value is 10 seconds.

• LSA Group Pacing – The interval at which LSAs are collected into a group and refreshed, checksummed, or aged. Valid values range from 10 to 1800; the default value is 240 seconds.

Default Information Originate

Settings used by an ASBR to generate a default external route into an OSPF routing domain.

• Enable Default Information Originate – Check this box to enable generation of a default route into the OSPF routing domain; the following options become available:

  • Always advertise the default route – Check this box to always advertise the default route.

  • Metric Value – Enter the OSPF metric for the default route. Valid values range from 0 to 16777214; the default value is 1.

  • Metric Type – Choose the external link type associated with the default route advertised into the OSPF routing domain. The choices are 1 or 2, indicating a Type 1 or a Type 2 external route. The default value is 2.

  • Route Map – (Optional) Enter or Select a route map object to apply. The routing process generates the default route if the route map is satisfied.

Non Stop Forwarding Tab

Enable Cisco Non Stop Forwarding Capability

Enables configuration of Cisco nonstop forwarding (NSF) operations.

Enable Cisco Non Stop Forwarding Helper mode

Enables Cisco nonstop forwarding (NSF) helper mode.

When an ASA has NSF enabled, it is said to be NSF-capable and will operate in graceful restart mode--the OSPF router process performs nonstop forwarding recovery due to a Route Processor (RP) switchover. By default, the neighboring ASAs of the NSF-capable ASA will be NSF-aware and will operate in NSF helper mode. When the NSF-capable ASA is performing graceful restart, the helper ASAs assist in the nonstop forwarding recovery process.

If you do not want the ASA to help the restarting neighbor with nonstop forwarding recovery, clear the Enable Cisco Non Stop Forwarding Helper mode option.

Enable Cisco Non Stop Forwarding

Enables Cisco nonstop forwarding (NSF).

Cancel NSF restart when non-NSF-aware neighboring networking devices are detected (Enforce Global)

If neighbors that are not NSF-aware are detected on a network interface during an NSF graceful restart, restart is aborted on that interface only and graceful restart will continue on other interfaces. To cancel restart for the entire OSPF process when neighbors that are not NSF-aware are detected during restart, select the Cancel NSF restart when non-NSF-aware neighboring networking devices are detected (Enforce Global) option.

Enable IETF Non Stop Forwarding Capability

Enables configuration of Internet Engineering Task Force (IETF) NSF operations.

Enable IETF Non Stop Forwarding Helper mode

Enables IETF nonstop forwarding (NSF) helper mode.

When an ASA has NSF enabled, it is said to be NSF-capable and will operate in graceful restart mode--the OSPF router process performs nonstop forwarding recovery due to a Route Processor (RP) switchover. By default, the neighboring ASAs of the NSF-capable ASA will be NSF-aware and will operate in NSF helper mode. When the NSF-capable ASA is performing graceful restart, the helper ASAs assist in the nonstop forwarding recovery process.

If you do not want the ASA to help the restarting neighbor with nonstop forwarding recovery, clear the Enable IETF Non Stop Forwarding Helper mode option.

Enable Strict Link State advertisement checking

Enables strict link-state advertisement (LSA) checking for IETF NSF helper mode.

Enable IETF Non Stop Forwarding

Enables IETF nonstop forwarding (NSF).

Length of graceful restart interval

(Optional) Specifies the length of the graceful restart interval, in seconds. The range is from 1 to 1800. The default is 120.

OSPF Process

When adding a new area, choose the OSPF process ID for the OSPF process for which the area is being added. If there is only one OSPF process enabled on the security appliance, that process is selected by default. When editing an existing area, you cannot change the OSPF process ID.

Area ID

When adding a new area, enter the area ID. You can specify the area ID as either a decimal number or an IP address. Valid decimal values range from 0 to 4294967295. You cannot change the area ID when editing an existing area.

Area Type

Normal

Choose this option to make the area a standard OSPF area. This option is selected by default when you first create an area.

Stub

Choosing this option makes the area a stub area. Stub areas do not have any routers or areas beyond it. Stub areas prevent AS External LSAs (Type 5 LSAs) from being flooded into the stub area. When you create a stub area, you can prevent summary LSAs (Type 3 and 4) from being flooded into the area by deselecting the Summary check box.

Summary (allows sending LSAs into the stub area)

When the area being defined is a stub area, deselecting this check box prevents LSAs from being sent into the stub area. This check box is selected by default for stub areas.

NSSA

Choose this option to make the area a not-so-stubby area. NSSAs accept Type 7 LSAs. When you create a NSSA, you can prevent summary LSAs from being flooded into the area by deselecting the Summary check box. You can also disable route redistribution by deselecting the Redistribute check box and enabling Default Information Originate.

Redistribute (imports routes to normal and NSSA areas)

Deselect this check box to prevent routes from being imported into the NSSA. This check box is selected by default.

Summary (allows sending LSAs into the NSSA area)

When the area being defined is a NSSA, deselecting this check box prevents LSAs from being sent into the stub area. This check box is selected by default for NSSAs.

Default Information Originate (generate a Type 7 default)

Select this check box to generate a Type 7 default into the NSSA. This check box is deselected by default.

Metric Value

Specifies the OSPF metric value for the default route. Valid values range from 0 to 16777214. The default value is 1.

Metric Type

The OSPF metric type for the default route. The choices are 1 (Type 1) or 2 (Type 2). The default value is 2.

Network

The IP address and network mask of the network or host to be added to the area. Use 0.0.0.0 with a netmask of 0.0.0.0 to create the default area. You can only use 0.0.0.0 in one area.

Authentication

Contains the settings for OSPF area authentication.

• None—Choose this option to disable OSPF area authentication. This is the default setting.

• Password—Choose this option to use a clear text password for area authentication. This option is not recommended where security is a concern.

• MD5—Choose this option to use MD5 authentication.

Default Cost

Specify a default cost for the area. Valid values range from 0 to 65535 for ASA devices earlier than 9.2(1) and from 0 to 16777214 for ASA 9.2(1)+. The default value is 1.

OSPF Process

Select the OSPF process to which the route summary applies. You cannot change this value when editing an existing route summary entry.

Area

Select the area ID of the area to which the route summary applies. You cannot change this value when editing an existing route summary entry.

Network

The IP address and mask of the network for the routes being summarized.

Advertise

Select this check box to set the address range status to “advertise”. This causes Type 3 summary LSAs to be generated. Deselect this check box to suppress the Type 3 summary LSA for the specified networks.

OSPF Process

The OSPF process associated with the static neighbor.

Neighbor

The IP address of the static neighbor.

Interface

The interface associated with the static neighbor.

OSPF Process

Select the OSPF process associated with the route redistribution entry.

Route Type

Select the source protocol from which the routes are being redistributed. You can choose one of the following options:

• BGP—Redistribute routes from the BGP routing process.

• Connected—Redistributes connected routes (routes established automatically by virtue of having IP address enabled on the interface) to the OSPF routing process. Connected routes are redistributed as external to the AS.

• EIGRP—Redistributes routes from the EIGRP routing process. Choose the autonomous system number of the EIGRP routing process from the list.

• OSPF—Redistributes routes from another OSPF routing process. If you choose this protocol, the Match options on this dialog box become visible. These options are not available when redistributing static, connected, RIP, BGP, or EIGRP routes.

• RIP—Redistributes routes from the RIP routing process.