Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to route connections that are going outbound from my private network to an external IP via another host that is on my internal network.

Should the following work?

For example: External IP is

route inside 1

So that when any host on my network tries to reach it ends up going to first.

share|improve this question
up vote 0 down vote accepted

I've been fiddling with that but with little success before. Some sources claim that ASA will never send icmp redirects, which is necessary to let the other clients on inside know that there's another gateway for the specific destination, while other sources claim that ASA up to 8.2(1) will not do it, implying that newer will do. IIRC, I tested on 8.3 with little success.

With a little luck it'll work and maybe I just gave up too early. You will definitely want the same-security rule:

same-security-traffic permit intra-interface

Make sure there's no funky nat, and that your access_in acl allows it. I ended up sticking the particular device (in my case an openvpn router) on another (sub)interface to achieve the routing. Don't forget to report back on your success or failure!

share|improve this answer
3molo has it right. Adding the 'same-security-traffic permit intra-interface' solved my issue. – pico May 6 '13 at 19:08

Why you use "inside"? Can you post ASA "show route" command output?

If you want to reach an external ip, you can use:

route outside [External Network] [Mask] gateway 

Ex: route outside

Where "outside" is the interface that connected to external network.

share|improve this answer
I believe the interface is actually where the gateway is connected, not where the external network is connected. – Alex May 6 '13 at 16:30

I believe that route statement should work. I would suggest maybe moving the route to the device before the ASA.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.