Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Cisco ASA routing a /32 of public addresses (non RFC-1812) through a private link. When the device sees the destination address it selects the private route instead of going out over the public network. This works great but I am now trying to exclude 4 IP's from the private route. Traffic to these addresses should go over the public internet instead of being routed over the private network. Can I just add anothe route for these four IP's or do I have to modify the existing route for the /32?

share|improve this question
    
Well, what have you tried to do and what have the results been? –  Sandokan Dec 4 '12 at 15:04
    
I haven't tried anything yet because its technically not my device. I'm trying to convince the other admin to make the changes on his side because otherwise I have to put these hosts on another subnet entirely which means downtime for a production system. I would like to know if its even possible before pursuing the issue further. –  Justin Dec 4 '12 at 15:09

2 Answers 2

Routing decisions are made by the longest prefix match. Par example when you route the network 192.168.0.0/24 out on dmz1 interface and you want to route 192.168.0.1/32 on interface dmz2 then this can be done by just adding the route

route dmz2 192.168.0.1 255.255.255.255 a.b.c.d

because the prefix /32 is longer then /24.

/32 is the longest possible prefix match. so in your config you had to remove the routes for the four hosts and add the new routes (CLI). If you are using ASDM you can edit the routes.

share|improve this answer

No, better to add an a ACL to first block the 4 IPs to be routed through the private network interface, and then have a route in place to take them over the public network. You will need to identify the routing logic of how the traffic is coming into your network first and assign it to the right interface.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.