ASAv: static routes

[sdargoeuves]

Adds static route support to ASAv.

• IPv4 and IPv6 static routes with directly-connected next hops (route <nameif> ... / ipv6 route <nameif> ...)
• Discard routes (Null0)
• max_nexthop: 1: ASA rejects equal-cost routes over different interfaces ("Cannot add route entry, conflict with existing routes")

Caveats: no indirect next hops (ASA needs the outgoing interface), no ECMP across interfaces.

Tested on ASAv 9.18(1) & 9.24(1):

• routing/20-static.yml: pass (IPv4 and IPv6)
• routing/25-static-discard.yml: pass (IPv4 and IPv6)

Test Results

### Routing - routing/20-static.yml

Use this topology to test global IPv4 and IPv6 static routes. DUT has
to have static routes for loopback addresses of X1 and X2.

[ospfv2_adj] Check OSPFv2 adjacency between X1 and x2 [ node(s): x1 ]
[PASS]       x1: OSPFv2 neighbor 10.0.0.3 is in state Full/-
[PASS]       Test succeeded in 0.2 seconds

[ospfv3_adj] Check OSPFv3 adjacency between X1 and x2 [ node(s): x1 ]
[PASS]       x1: OSPFv3 neighbor 10.0.0.3 is in state Full
[PASS]       Test succeeded in 0.2 seconds

[ping_x1_v4] Ping DUT from loopback IPv4 address of X1 [ node(s): x1 ]
[PASS]       x1: Ping to ipv4 10.1.0.1 from 10.0.0.2/32 succeeded
[PASS]       Test succeeded in 0.2 seconds

[ping_x1_v6] Ping DUT from loopback IPv6 address of X1 [ node(s): x1 ]
[PASS]       x1: Ping to ipv6 2001:db8:3::1 from 2001:db8:cafe:42::1/64 succeeded
[PASS]       Test succeeded in 0.2 seconds

[ping_x2_v4] Ping DUT from loopback IPv4 address of X2 [ node(s): x2 ]
[PASS]       x2: Ping to ipv4 10.1.0.1 from 10.0.0.3/32 succeeded
[PASS]       Test succeeded in 0.3 seconds

[ping_x2_v6] Ping DUT from loopback IPv6 address of X2 [ node(s): x2 ]
[PASS]       x2: Ping to ipv6 2001:db8:3::1 from 2001:db8:cafe:43::1/64 succeeded
[PASS]       Test succeeded in 0.2 seconds

[SUCCESS]    Tests passed: 6

✅ Tested on 9.18.1 & 9.24.1

Routing - routing/25-static-discard.yml

Use this topology to test 'discard' IPv4 and IPv6 static routes.
H1 should be able to reach H2 but not H3 (due to a discard static route)


[WARNING] The following warnings were generated during the 'netlab up' processing
[WARNING] vrf_check: Device asav/dut does not support VRFs
[ra]         Check RA-generated default route [ node(s): h1,h2,h3 ]
[WAITING]    Waiting for RA message to generate the default route (retrying for 30 seconds)
[PASS]       h1: IPv6 default route is present
[PASS]       h3: IPv6 default route is present
[PASS]       h2: IPv6 default route is present
[PASS]       Test succeeded in 3.4 seconds

[ping_h2_v4] IPv4 ping H2 from H1 [ node(s): h1 ]
[PASS]       h1: Ping to ipv4 h2 (172.16.42.3) succeeded
[PASS]       Test succeeded in 0.2 seconds

[ping_h2_v6] IPv6 ping H2 from H1 [ node(s): h1 ]
[PASS]       h1: Ping to ipv6 h2 succeeded
[PASS]       Test succeeded in 2.2 seconds

[ping_h3_v4] IPv4 ping H3 from H1 [ node(s): h1 ]
[PASS]       h1: Ping to ipv4 h3 (172.16.42.42) failed as expected
[PASS]       Test succeeded in 3.2 seconds

[ping_h3_v6] IPv6 ping H3 from H1 [ node(s): h1 ]
[PASS]       h1: Ping to ipv6 h3 failed as expected
[PASS]       Test succeeded in 3.2 seconds

[v_warning]  Starting test
[WARNING]    Device asav does support VRFs, skipping VRF-specific tests

[INFO]       One test out of 8 tests generated a warning
[WARNING] netlab validate: Validation generated a warning

✅ Tested on 9.18.1 & 9.24.1

[ipspace]

The "no indirect static routes" condition cannot be enforced with a feature flag, it needs a device quirk. Fortunately, we already have one in "_common" module (used by Linux), it just needs to be called.

[sdargoeuves]

[...] it needs a device quirk. Fortunately, we already have one in "_common" module (used by Linux), it just needs to be called.
Thanks for this tip, I've added it, and tested with a direct & indirect static route, I've got the desired outcome.

[ipspace]

Thank you!