cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
618
Views
0
Helpful
6
Replies

Default Route Question

agent2007
Level 1
Level 1

Hey All,

Is it possible to set the default route on an asa to something different for one particular IP address?

so everyone uses the route outside 0.0.0.0 0.0.0.0 1.2.3.4

and a particular ip (192.168.1.10) uses a different default gateway?

hope that makes sense

if thats not possible is it possible to set a defult route for a destination port i.e anything using port 443 goes to another defined route.

6 Replies 6

Mahesh Gohil
Level 7
Level 7

Hi,

Default route is kind of static route where we have very few options to work with

however your requirement can be fulfilled with PBR (policy based routing)

like one below


route-map TEST permit 10
match ip address 101
set ip next-hop A.B.C.D

access-list 101 permit ip host 192.168.1.10 any

int fa0/0
ip policy route-map TEST

Here you create IP access list and match source IP. call that in route map with match and set statement and then apply that route map

to an interface.

please note that there are many options available after match and set statement. You can use it as per youre requirement

hope this helps

Regards

Mahesh

Thanks for the reply but cisco asa does not support PBR

Jennifer Halim
Cisco Employee
Cisco Employee

No, unfortunately that is not a supported configuration on ASA firewall.

Jenifer, I see you have a cisco icon on your profile so assuming you work for them I have read that PBR is something that will feature very soon?  do you know anything about that?

for now i am going to try the following based on web traffic to go over your primary ISP link (x.x.x.x) and mail (smtp) traffic to go over the backup link (y.y.y.y)

route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
route backup 0.0.0.0 0.0.0.0  y.y.y.y 2

nat (inside) 1 0 0
global (outside) 1 interface
global (backup) 1 interface

static (outside,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0
static (backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0

hopefully it will work

Well, unfortunately you also can't configure 2 default gateway going out through 2 different interfaces. This is not a support configuration.

I haven't seen PBR on ASA on the roadmap, but I could be wrong.

so just incase anyone is interested my that configuation worked perfectly.

The only thing to point out is if your going to go this method, forget about inbound nat as source address will come in one interface and try go back out the default gateway

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: