Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What will happen if there is a static route in place telling the packet to go to routerA but there is also a crypto map telling the packet to go over the VPN? Will it hit the route table first or go over the VPN tunnel?

share|improve this question
up vote 3 down vote accepted

Routing table is used first. ASA needs it to figure out which interface the packet will go out. Pretty much everything depends on this interface (NAT rules, crypto maps, outbound ACLs when they are used), so it absolutely has to be looked up first.

Once the outbound interface is known, then ASA goes through (in this order) ACLs, inspects, NAT exemptions, NAT, VPN.

Here's the tricky part about the relationship between the routing table and VPN. Any packet that will be set through a tunnel actually interacts with the routing table twice: first when it's unencrypted and the firewall makes the interface determination, and then in encrypted form when the firewall sends it to its VPN peer. Obviously, the second route is looked up based on the VPN peer's routing and not the original packet's IP headers, so it may actually be different.

BTW, you can understand all this better if you run Packet Tracer in ASDM.

share|improve this answer
Good point - thanks! – Shane Madden Mar 13 '12 at 5:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.