I have a Cisco ASA routing a /32 of public addresses (non RFC-1812) through a private link. When the device sees the destination address it selects the private route instead of going out over the public network. This works great but I am now trying to exclude 4 IP's from the private route. Traffic to these addresses should go over the public internet instead of being routed over the private network. Can I just add anothe route for these four IP's or do I have to modify the existing route for the /32?

  • Well, what have you tried to do and what have the results been?
    – Sandokan
    Dec 4, 2012 at 15:04
  • I haven't tried anything yet because its technically not my device. I'm trying to convince the other admin to make the changes on his side because otherwise I have to put these hosts on another subnet entirely which means downtime for a production system. I would like to know if its even possible before pursuing the issue further.
    – Justin
    Dec 4, 2012 at 15:09

2 Answers 2


Routing decisions are made by the longest prefix match. Par example when you route the network out on dmz1 interface and you want to route on interface dmz2 then this can be done by just adding the route

route dmz2 a.b.c.d

because the prefix /32 is longer then /24.

/32 is the longest possible prefix match. so in your config you had to remove the routes for the four hosts and add the new routes (CLI). If you are using ASDM you can edit the routes.


No, better to add an a ACL to first block the 4 IPs to be routed through the private network interface, and then have a route in place to take them over the public network. You will need to identify the routing logic of how the traffic is coming into your network first and assign it to the right interface.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .