S
shade91
Guest
I never figured out why - but why doesn't the ASA or PIX line of firewalls not support BGP? All they support is RIP/OSPF.
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
Navigation
Install the app
How to install the app on iOS
Follow along with the video below to see how to install our site as a web app on your home screen.
Note: This feature may not be available in some browsers.
More options
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
Taking a guess...
Maybe because those are security appliances and not router appliances. If you have a router sitting in front of your ASA/PIX, you can run both BGP and RIP/OSPF. Most of the time you don't need to do that on a security appliance though as a default route is usually enough. if there are a large amount of internal subnets, I use route summarization to statically configure the routes.
Maybe because those are security appliances and not router appliances. If you have a router sitting in front of your ASA/PIX, you can run both BGP and RIP/OSPF. Most of the time you don't need to do that on a security appliance though as a default route is usually enough. if there are a large amount of internal subnets, I use route summarization to statically configure the routes.
S
shade91
Guest
I was thinking maybe that too when I tried doing policy-based routing on the ASA. Ah well.
I'd recommend contacting your Cisco account team and logging a feature request with them. They pass it up to the people responsible for developing the product, and they try to include the most popular feature requests in future releases.
PIX/ASA 8.0 will have support for EIGRP, and one of the recent features in 7.x was OSPF-over-IPSec without the need for GRE. Routing functionality is coming along, but as you have seen it does not match what a true router has.
PIX/ASA 8.0 will have support for EIGRP, and one of the recent features in 7.x was OSPF-over-IPSec without the need for GRE. Routing functionality is coming along, but as you have seen it does not match what a true router has.
I'm not really seeing a significant business case to have all routing features on your security device. That is unless you want an all in one device. If that is the case, I would suspect with the device doing all that, it may tax the processor.
Granted that is speaking on a large user basis, obviously such a device would work fine in a small business environment.
Granted that is speaking on a large user basis, obviously such a device would work fine in a small business environment.
Sure, there are plenty of legit business cases where it makes sense to have an IGP running on a security device. BGP is an entirely different animal. One of the reasons we don't support it on the ASA is that BGP is typically an ISP-facing protocol and the ASA does not have serial ports. However, more and more ISP's are starting to run fiber, or copper ethernet links to customers as WAN links, which the ASA does support.
S
shade91
Guest
As far as I know, Sonicwall and most of the linux-branded firewalls support BGP. While it is commonly an ISP-facing routing protocol, using the 'it's not a routing device' and 'it's an isp-facing protocol' would be a chicken-shit cop-out for Cisco to not put such a simple feature in a $5,000 device. Even Juniper's line of firewalls supports BGP!
The reason though that I need this is that OSPF (on the ASA) and BGP (on a pair of 2811's) aren't working together too nicely.
The reason though that I need this is that OSPF (on the ASA) and BGP (on a pair of 2811's) aren't working together too nicely.
Boscoh, sounds like you work for Cisco.
Question though (I should probably just look it up myself), but most routers you can get the T1/csu/dsu card module. Are those modules not supported for the ASA's and PIX?
To answer the first point, yes I do work for Cisco.
On your T1 CSU/DSU question: no, they are not supported by the PIX or the ASA. If you need a security device that can support WAN interface cards you'd have to look at the ISR series.
As far as I know, Sonicwall and most of the linux-branded firewalls support BGP. While it is commonly an ISP-facing routing protocol, using the 'it's not a routing device' and 'it's an isp-facing protocol' would be a chicken-shit cop-out for Cisco to not put such a simple feature in a $5,000 device. Even Juniper's line of firewalls supports BGP!
The reason though that I need this is that OSPF (on the ASA) and BGP (on a pair of 2811's) aren't working together too nicely.
It does seem that it would be rather simple to add it into the ASA/PIX, but keep in mind that it isn't the same code as IOS. It would require a lot of testing and QA to make sure it doesn't impact the stability of the rest of the code. Don't take that as an excuse as to why we don't have it, I just want to articulate that once the feature is considered it will take some time to test it even after the code has been created. Major features (which BGP in PIX/ASA would be) undergo a LOT of testing.
Going back to what I said previously, I would strongly recommend that you get in touch with your account team and tell them you need the feature. The account teams forward their feature requests to the product developers and if there is enough customer interest in the feature then they will typically start to look at it closely. I don't have any data to suggest what the interest level is in BGP via PIX/ASA right now, but it is something a lot of us are starting to get more questions about. Every request counts, so make sure you get your account team to sound off internally for what you want to see in our stuff.
S
shade91
Guest
Thanks. I'll look into that.
BTW - Do you work out of the San Jose corporate HQ?
BTW - Do you work out of the San Jose corporate HQ?