1

What will happen if there is a static route in place telling the packet to go to routerA but there is also a crypto map telling the packet to go over the VPN? Will it hit the route table first or go over the VPN tunnel?

1 Answer 1

3

Routing table is used first. ASA needs it to figure out which interface the packet will go out. Pretty much everything depends on this interface (NAT rules, crypto maps, outbound ACLs when they are used), so it absolutely has to be looked up first.

Once the outbound interface is known, then ASA goes through (in this order) ACLs, inspects, NAT exemptions, NAT, VPN.

Here's the tricky part about the relationship between the routing table and VPN. Any packet that will be set through a tunnel actually interacts with the routing table twice: first when it's unencrypted and the firewall makes the interface determination, and then in encrypted form when the firewall sends it to its VPN peer. Obviously, the second route is looked up based on the VPN peer's routing and not the original packet's IP headers, so it may actually be different.

BTW, you can understand all this better if you run Packet Tracer in ASDM.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .