Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Network A Firewall is .1 Host A is .2

Network B Firewall is .1 Host B is .2

Two Cisco ASA's. IPSec tunnel with a crypo map that secures <->

Let's say two hosts, and need to talk to each other. Normally I have to enter a persistent static route on a each host along the lines of:

route add mask metric 1 -p (on the "A" box)

I also have to enter another persistent static route on the .16 host in order for the traffic to know how to get back to the .15 network. Note that the default for each machine IS the firewall, so .1.

I have no problem adding persistent routes on Windows/ESX/*nux machines but what about a smart switch in the .16 network that I want to manage from the .15 network.

Do I need to run a routing protocol? Do I need to have Reverse Route Injection enabled on both ends of the IPSec tunnel? Should I add a route on the firewall? If so, how do you formulate it? Does it get a metric of 1 and my default route get a metric of 2?

share|improve this question

migrated from Jun 2 '10 at 22:50

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

If the default gateways on Hosts A and B are their respective firewall boxes (.1) then it should already be working.

All you're doing by adding those static routes is to tell the host to direct traffic for that subnet to the firewall - which it should already be doing if the default gateway is set correctly.

Also are you sure the subnet mask is set correctly on host A & B - if you had it as that would create the symptoms you describe.

share|improve this answer
+1 Agree. WIth ipsec you don't need to set a static route. WHen a packet arrives at the GW, it sees that the destination is in the Ipsec rule, so it forwards the packets through the tunnel – Pier Jun 3 '10 at 8:36
Yes you are correct. The B network devices did not have a default gateway set. Works now, thanks. – Brent Jun 3 '10 at 16:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.