1-4
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Static and Default Routes
Configuring Static and Default Routes
Examples
The following example shows static routes that are equal cost routes that direct traffic to three different
gateways on the outside interface. The ASA distributes the traffic among the specified gateways.
hostname(config)#
route outside 10.10.10.0 255.255.255.0 192.168.1.1
hostname(config)#
route outside 10.10.10.0 255.255.255.0 192.168.1.2
hostname(config)#
route outside 10.10.10.0 255.255.255.0 192.168.1.3
Configuring a Default Static Route
A default route identifies the gateway IP address to which the ASA sends all IP packets for which it does
not have a learned or static route. A default static route is simply a static route with 0.0.0.0/0 as the
destination IP address. Routes that identify a specific destination take precedence over the default route.
Note
In Versions 7.0(1) and later, if you have two default routes configured on different interfaces that have
different metrics, the connection to the ASA that is made from the higher metric interface fails, but
connections to the ASA from the lower metric interface succeed as expected.
You can define up to three equal cost default route entries per device. Defining more than one equal cost
default route entry causes the traffic sent to the default route to be distributed among the specified
gateways. When defining more than one default route, you must specify the same interface for each
entry.
If you attempt to define more than three equal cost default routes or a default route with a different
interface than a previously defined default route, you receive the following message:
“ERROR: Cannot add route entry, possible conflict with existing routes.”
You can define a separate default route for tunneled traffic along with the standard default route. When
you create a default route with the tunneled
option, all traffic from a tunnel terminating on the ASA that
cannot be routed using learned or static routes is sent to this route. For traffic emerging from a tunnel,
this route overrides any other configured or learned default routes.
Limitations on Configuring a Default Static Route
The following restrictions apply to default routes with the tunneled option:
•
Do not enable unicast RPF (
ip verify reverse-path
command) on the egress interface of a tunneled
route, because this setting causes the session to fail.
•
Do not enable TCP intercept on the egress interface of the tunneled route, because this setting causes
the session to fail.
•
Do not use the VoIP inspection engines (CTIQBE, H.323, GTP, MGCP, RTSP, SIP, SKINNY), the
DNS inspect engine, or the DCE RPC inspection engine with tunneled routes, because these
inspection engines ignore the tunneled route.
•
You cannot define more than one default route with the tunneled option.
•
ECMP for tunneled traffic is not supported.
To add or edit a tunneled default static route, enter the following command:
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......