I have a Cisco ASA routing a /32 of public addresses (non RFC-1812) through a private link. When the device sees the destination address it selects the private route instead of going out over the public network. This works great but I am now trying to exclude 4 IP's from the private route. Traffic to these addresses should go over the public internet instead of being routed over the private network. Can I just add anothe route for these four IP's or do I have to modify the existing route for the /32?
-
Well, what have you tried to do and what have the results been?– SandokanDec 4, 2012 at 15:04
-
I haven't tried anything yet because its technically not my device. I'm trying to convince the other admin to make the changes on his side because otherwise I have to put these hosts on another subnet entirely which means downtime for a production system. I would like to know if its even possible before pursuing the issue further.– JustinDec 4, 2012 at 15:09
Add a comment
|
2 Answers
Routing decisions are made by the longest prefix match. Par example when you route the network 192.168.0.0/24 out on dmz1 interface and you want to route 192.168.0.1/32 on interface dmz2 then this can be done by just adding the route
route dmz2 192.168.0.1 255.255.255.255 a.b.c.d
because the prefix /32 is longer then /24.
/32 is the longest possible prefix match. so in your config you had to remove the routes for the four hosts and add the new routes (CLI). If you are using ASDM you can edit the routes.
answered Dec 4, 2012 at 20:51
No, better to add an a ACL to first block the 4 IPs to be routed through the private network interface, and then have a route in place to take them over the public network. You will need to identify the routing logic of how the traffic is coming into your network first and assign it to the right interface.