CCIE Study Notes

Let me start this section with a practical note: your routing should basically be done with routers and not firewalls. Do your "heavy lifting" of routing (and coarse screening) with real routers that sandwich the firewall. This should be common sense. You want to filter out most junk before it hits the firewall to conserve resources for legitimate traffic. Having said that, you also have to realize that any firewall has multiple interfaces. You have at least an inside and outside (and optionally one or more DMZ interfaces). If you have more than one interface - the device needs to determine which interface to use for outgoing traffic. Of course, there is the concept of a "default" gateway - which is where you send traffic to all unknown destinations. But if you have two interfaces, you have to decide which one is the default. And you have to give the firewall a way to know what traffic goes out the other interface(s). This requires routing. [Note: transparent firewalls do not require routing since they operate at Layer 2.]

One of the first things you have to know is what network(s) resides on the other side of the cable attached to the interfaces of your ASA. Your inside and outside interfaces are going to be relatively easy. You know your inside networks and what protocol you are running in your internal network. The "Internet" on the outside interface would be the one you want to use for a "default" - since you don't want your firewall to need full routes to the outside networks to route traffic there. But what about your DMZ traffic? Depending on the function of your DMZs, that's probably where you want to put static routes. Your DMZ will either have a subnet of devices with the same purpose (directly connected network) or connect to a vendor network. Vendors will most likely not run a routing protocol with you. Some might - but it will probably be a different protocol from the one they run internally. So you have to know routing to get your traffic from the firewall to its destination.

Static routes are easy to configure, but do not scale well in large environments. You should know how to configure a static route in both the CLI and ASDM. In the ASDM, this is under Configuration > Device Setup > Routing > Static Routes. For the CLI you use the "route" command.
route interface network netmask gateway metric

route inside 192.168.100.0 255.255.255.0 192.168.22.1 1

To display the routing table from the CLI use the command "show route" or the ASDM path Monitoring > Routing > Routes.

RIP is fairly old, but is sometimes still used. RIP has a limit of 15 hops (16 means unreachable). RIP has a version 1 and version 2. All of the routing in the ASDM is configured under Configuration > Device Setup > Routing menu items. Don't forget the issues that RIP has with discontiguous networks. Only RIPv2 supports CIDR and authentication. RIPv2 supports plain-text and MD5 authentication. Since Routing Protocols were covered in section 1.5, I won't repeat it and move forward.

EIGRP is also fairly old and is Cisco proprietary. Again, this was previously covered in section 1.5, so let's just hit some highlights. It uses DUAL to calculate route options. Split horizon is enabled on all interfaces by default. The ASA supports EIGRP route filtering and EIGRP Authentication (MD5). SIA = Stuck In Active.

OSPF is probably the routing protocol you will use most - and therefore most likely to appear on the exam. OSPF itself was covered in 1.5 and they probably won't ask much specifically on OSPF itself (that would be R/S material), but may be inclined to ask about ASA's OSPF support. It supports intra-area, inter-area and external (Type 1 and Type 2) routes. It could be a DR, BDR, ABR or ASBR and supports route redistribution. It supports virtual links and OSPF authentication (both clear-text and MD5). It also supports stub areas and NSSAs. Those are the main things it supports - there are others listed in the ASA book, but those are the ones I would remember. If you know OSPF (and you should), any OSPF question shouldn't be a problem. The main difference between OSPF on a router and OSPF on the firewall is that the commands on the ASA don't use the "ip" keyword. Instead of "show ip ospf neighbor" you just use "show ospf neighbor" instead. Don't forget about OSPFv3! For that, you use "ipv6 router ospf 10" - note that the ipv6 is at the beginning.

The ASA is also capable of multicast routing and supports both stub multicast routing (can be an IGMP proxy) and PIM multicast routing. Think about PIM-DM and PIM-SM and would you really want your firewall participating in Dense Mode? I think not. Cisco ASA supports PIM-SM as the multicast routing protocol. It supports IGMP versions 1 and 2, but version 2 is the default. It also supports bidirectional PIM. I would think any questions in this area would be on basic ASA support of multicasting rather than any specific item. [I doubt you'll get anything like: "what is the default join-prune-interval?" on the written exam. The lab, however may ask you to configure something to be twice the default interval.]

And with that, I'm going to end this section and move on. Most of this was covered previously and I'm pretty confident in this area. [That networking and R/S background really helps.]