No Passive-Interface Error – Troubleshooting Guide

ciscocisco-ioseigrprouterrouting

I'm trying to nest some EIGRP configurations on a router in GNS3.

I'm trying to connect the EIGRP 2801 in SW01 to RTR-01 and EIGRP 2864 to RTR-02 when I do.

When I put no passive-interface FastEthernet 2/0 on address-family vrf 4 this error is shown:

%EIGRP: Interface FastEthernet2/0 is not a member of this routing table

Why?

INFO

10.28.79.4/30 between SW01 / RTR-01
10.28.79.8/30 between SW02 / RTR-02
10.28.79.0/30 between RTR-01 / RTR-02
Loopback 0 at RTR-01 10.28.254.1/32
Loopback 0 at RTR-02 10.28.254.2/32
10.28.66.0/26 in SW-ESA
10.28.78.0/26 in SW-ESA
10.28.1.0/26 in SW-01
EIGRP 2801 in SW-01 and RTR-01
EIGRP 2864 in SW-ESA and RTR-02
BGP 65001 between RTR-01 and RTR-02

RTR-01 configuration:

version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname RTR-01
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip cef
!
ip vrf 1
 description scada
 rd 65001:1
 route-target export 65001:1
 route-target import 65001:1
!
ip vrf 4
 description intranet
 rd 65001:4
 mdt default 239.1.1.1
 mdt data 238.2.2.0 0.0.0.255 threshold 1
 route-target export 65001:4
 route-target import 65001:4
!
ip domain name xx.xx.xxx
no ipv6 cef
!
multilink bundle-name authenticated
!
ip ssh version 2
!
interface Loopback0
 ip address 10.28.254.1 255.255.255.255
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex full
!
interface GigabitEthernet1/0
 ip address 10.28.79.1 255.255.255.252
 negotiation auto
!
interface FastEthernet2/0
 ip address 10.28.79.5 255.255.255.252
 speed auto
 duplex auto
!
interface FastEthernet2/1
 no ip address
 shutdown
 speed auto
 duplex auto
!
router eigrp 8000
 !
 address-family ipv4 vrf 4 autonomous-system 2801
  redistribute bgp 65001 metric 10000 100 255 1 1500
  network 10.0.0.0
  network 10.28.1.0 0.0.0.63
  distribute-list prefix default out
 exit-address-family
!
router bgp 65001
 bgp router-id 10.28.254.1
 bgp log-neighbor-changes
 network 10.28.1.0 mask 255.255.255.192
 network 10.28.254.0 mask 255.255.255.0
 redistribute eigrp 1094 route-map depurascada
 neighbor 10.28.254.2 remote-as 65001
 neighbor 10.28.254.2 update-source Loopback0
 !
 address-family vpnv4
  neighbor 10.28.254.2 activate
  neighbor 10.28.254.2 send-community extended
 exit-address-family
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip prefix-list default seq 5 permit 0.0.0.0/0 le 8
!
ip prefix-list depuraigp seq 5 permit 10.0.0.0/8 ge 32
ip prefix-list depuraigp seq 10 deny 10.0.0.0/8 ge 30
ip prefix-list depuraigp seq 15 permit 0.0.0.0/0 le 29
!
ip prefix-list depuravrf1 seq 5 deny 0.0.0.0/0 ge 30
ip prefix-list depuravrf1 seq 10 permit 0.0.0.0/0 le 29
!
ip prefix-list depuravrf4 seq 5 permit 10.0.0.0/8 ge 32
ip prefix-list depuravrf4 seq 10 deny 10.0.0.0/8 ge 30
ip prefix-list depuravrf4 seq 15 permit 0.0.0.0/0 le 29
access-list 103 deny   tcp any any eq 445
access-list 103 deny   tcp any any eq 139
access-list 103 permit ip any any
!
route-map depurascada permit 5
 match ip address prefix-list depuravrf1
!
route-map depuraintra permit 5
 match ip address prefix-list depuravrf4
!
route-map nobucle permit 5
 set extcommunity soo 65001:1
!
mpls ldp router-id Loopback0
!
control-plane
!
line con 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 login
!
!
end

RTR-02 configuration:

version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname RTR-02
!
boot-start-marker
boot-end-marker
!
no aaa new-model
ip cef
!
ip vrf 1
 description scada
 rd 65001:1
 route-target export 65001:1
 route-target import 65001:1
!
ip vrf 4
 description intranet
 rd 65001:4
 mdt default 239.1.1.1
 mdt data 238.2.2.0 0.0.0.255 threshold 1
 route-target export 65001:4
!
ip domain name xx.xx.xxx
no ipv6 cef
!
multilink bundle-name authenticated
!
ip ssh version 2
!
interface Loopback0
 ip address 10.28.254.2 255.255.255.255
!
interface FastEthernet0/0
 no ip address
 shutdown
 duplex full
!
interface GigabitEthernet1/0
 ip address 10.28.79.2 255.255.255.252
 negotiation auto
!
interface FastEthernet2/0
 ip address 10.28.79.9 255.255.255.252
 speed auto
 duplex auto
!
interface FastEthernet2/1
 no ip address
 shutdown
 speed auto
 duplex auto
!
router eigrp 8000
 !
 address-family ipv4 vrf 4 autonomous-system 2864
  redistribute bgp 65001 metric 10000 100 255 1 1500
  network 10.0.0.0
  passive-interface default
  distribute-list prefix default out
 exit-address-family
!
router bgp 65001
 bgp router-id 10.28.254.2
 bgp log-neighbor-changes
 network 10.28.78.0 mask 255.255.255.192
 network 10.28.254.0 mask 255.255.255.0
 redistribute eigrp 1094 route-map depurascada
 neighbor 10.28.254.1 remote-as 65001
 neighbor 10.28.254.1 update-source Loopback0
 !
 address-family vpnv4
  neighbor 10.28.254.1 activate
  neighbor 10.28.254.1 send-community extended
 exit-address-family
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip prefix-list default seq 5 permit 0.0.0.0/0 le 8
!
ip prefix-list depuraigp seq 5 permit 10.0.0.0/8 ge 32
ip prefix-list depuraigp seq 10 deny 10.0.0.0/8 ge 30
ip prefix-list depuraigp seq 15 permit 0.0.0.0/0 le 29
!
ip prefix-list depuravrf1 seq 5 deny 0.0.0.0/0 ge 30
ip prefix-list depuravrf1 seq 10 permit 0.0.0.0/0 le 29
!
ip prefix-list depuravrf4 seq 5 permit 10.0.0.0/8 ge 32
ip prefix-list depuravrf4 seq 10 deny 10.0.0.0/8 ge 30
ip prefix-list depuravrf4 seq 15 permit 0.0.0.0/0 le 29
access-list 103 deny   tcp any any eq 445
access-list 103 deny   tcp any any eq 139
access-list 103 permit ip any any
!
route-map depurascada permit 5
 match ip address prefix-list depuravrf1
!
route-map depuraintra permit 5
 match ip address prefix-list depuravrf4
!
route-map nobucle permit 5
 set extcommunity soo 65001:1
!
mpls ldp router-id Loopback0
!
control-plane
!
line con 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 login
!
end

This is the shown version:

BOOTLDR: 7200 Software (C7200-ADVIPSERVICESK9-M), Version 15.2(4)S5, RELEASE SOFTWARE (fc1)

Best Answer

You have to put your interfaces into vrf 4.

interface fa 2/0
ip vrf forwarding 4

An interface can only be in one vrf. Otherwise, how would the router know which interface to use?

If you don't specify a vrf, the interface is put into the global table. But your EIGRP process is configured to use vrf 4.

Your ASA configuration:

route outside 0.0.0.0 0.0.0.0 172.16.1.1 1

This will provide a default route via the outside interface, but how will the ASA know how to reach subnets residing behind the Layer 3 Distribution Switch?

You'll need to add routes to the internal subnets via the inside interface using the Layer 3 Distribution Switch as the next-hop IP address.

ASA static routing example:

route inside 172.19.12.0 255.255.255.240 172.16.2.2
route inside 172.19.3.0 255.255.255.0 172.16.2.2
route inside 172.20.100.0 255.255.255.224 172.16.2.2

Your Cisco Router's configuration:

ip route 0.0.0.0 0.0.0.0 200.200.200.200

Additionally, how will your border router know how to reach subnets other than it's connected routes, and the catch all default route via the outside interface's next-hop address 200.200.200.200?

Router static routing example:

ip route 172.19.12.0 255.255.255.240 172.16.1.10
ip route 172.19.3.0 255.255.255.0 172.16.1.10
ip route 172.19.100.0 255.255.255.224 172.16.1.10
ip route 172.16.2.0 255.255.255.224 172.16.1.10

Routing – Creating a JunOS firewall filter based on dynamic routing properties

GRNET (the Greek Research and Education network) have developed a web application for customers to do this with Flowspec. The web portal has a BGP Flowspec backend which injects flowspec into your network. Highly configurable and in use on the 500-1,000 Gbps pan-European GEANT backbone: https://www.noc.grnet.gr/en/fod