Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to route connections that are going outbound from my private network to an external IP via another host that is on my internal network.

Should the following work?

For example: External IP is 1.1.1.1

route inside 1.1.1.1 255.255.255.255 192.168.0.4 1

So that when any host on my 192.168.0.0/24 network tries to reach 1.1.1.1 it ends up going to 192.168.0.4 first.

share|improve this question

3 Answers 3

up vote 0 down vote accepted

I've been fiddling with that but with little success before. Some sources claim that ASA will never send icmp redirects, which is necessary to let the other clients on inside know that there's another gateway for the specific destination, while other sources claim that ASA up to 8.2(1) will not do it, implying that newer will do. IIRC, I tested on 8.3 with little success.

With a little luck it'll work and maybe I just gave up too early. You will definitely want the same-security rule:

same-security-traffic permit intra-interface

Make sure there's no funky nat, and that your access_in acl allows it. I ended up sticking the particular device (in my case an openvpn router) on another (sub)interface to achieve the routing. Don't forget to report back on your success or failure!

share|improve this answer
    
3molo has it right. Adding the 'same-security-traffic permit intra-interface' solved my issue. –  pico May 6 '13 at 19:08

Why you use "inside"? Can you post ASA "show route" command output?

If you want to reach an external ip, you can use:

route outside [External Network] [Mask] gateway 

Ex: route outside 0.0.0.0 0.0.0.0 192.168.1.1

Where "outside" is the interface that connected to external network.

share|improve this answer
    
I believe the interface is actually where the gateway is connected, not where the external network is connected. –  Alex May 6 '13 at 16:30

I believe that route statement should work. I would suggest maybe moving the route to the device before the ASA.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.