Default Route Question

Unanswered Question
Sep 29th, 2010
User Badges:

Hey All,

Is it possible to set the default route on an asa to something different for one particular IP address?

so everyone uses the route outside

and a particular ip ( uses a different default gateway?

hope that makes sense

if thats not possible is it possible to set a defult route for a destination port i.e anything using port 443 goes to another defined route.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Mahesh Gohil Wed, 09/29/2010 - 02:53
User Badges:
  • Silver, 250 points or more


Default route is kind of static route where we have very few options to work with

however your requirement can be fulfilled with PBR (policy based routing)

like one below

route-map TEST permit 10
match ip address 101
set ip next-hop A.B.C.D

access-list 101 permit ip host any

int fa0/0
ip policy route-map TEST

Here you create IP access list and match source IP. call that in route map with match and set statement and then apply that route map

to an interface.

please note that there are many options available after match and set statement. You can use it as per youre requirement

hope this helps



agent2007 Wed, 09/29/2010 - 02:59
User Badges:

Thanks for the reply but cisco asa does not support PBR

Jennifer Halim Wed, 09/29/2010 - 05:18
User Badges:
  • Cisco Employee,

No, unfortunately that is not a supported configuration on ASA firewall.

agent2007 Wed, 09/29/2010 - 06:29
User Badges:

Jenifer, I see you have a cisco icon on your profile so assuming you work for them I have read that PBR is something that will feature very soon?  do you know anything about that?

for now i am going to try the following based on web traffic to go over your primary ISP link (x.x.x.x) and mail (smtp) traffic to go over the backup link (y.y.y.y)

route outside x.x.x.x 1
route backup  y.y.y.y 2

nat (inside) 1 0 0
global (outside) 1 interface
global (backup) 1 interface

static (outside,inside) tcp www www netmask
static (backup,inside) tcp smtp smtp netmask

hopefully it will work

Jennifer Halim Wed, 09/29/2010 - 06:37
User Badges:
  • Cisco Employee,

Well, unfortunately you also can't configure 2 default gateway going out through 2 different interfaces. This is not a support configuration.

I haven't seen PBR on ASA on the roadmap, but I could be wrong.

agent2007 Thu, 09/30/2010 - 03:47
User Badges:

so just incase anyone is interested my that configuation worked perfectly.

The only thing to point out is if your going to go this method, forget about inbound nat as source address will come in one interface and try go back out the default gateway


This Discussion