I'm trying to route connections that are going outbound from my private network to an external IP via another host that is on my internal network.

Should the following work?

For example: External IP is

route inside 1

So that when any host on my network tries to reach it ends up going to first.


I've been fiddling with that but with little success before. Some sources claim that ASA will never send icmp redirects, which is necessary to let the other clients on inside know that there's another gateway for the specific destination, while other sources claim that ASA up to 8.2(1) will not do it, implying that newer will do. IIRC, I tested on 8.3 with little success.

With a little luck it'll work and maybe I just gave up too early. You will definitely want the same-security rule:

same-security-traffic permit intra-interface

Make sure there's no funky nat, and that your access_in acl allows it. I ended up sticking the particular device (in my case an openvpn router) on another (sub)interface to achieve the routing. Don't forget to report back on your success or failure!

  • 3molo has it right. Adding the 'same-security-traffic permit intra-interface' solved my issue.
    – pico
    May 6 '13 at 19:08

Why you use "inside"? Can you post ASA "show route" command output?

If you want to reach an external ip, you can use:

route outside [External Network] [Mask] gateway 

Ex: route outside

Where "outside" is the interface that connected to external network.

  • I believe the interface is actually where the gateway is connected, not where the external network is connected.
    – Alex
    May 6 '13 at 16:30

I believe that route statement should work. I would suggest maybe moving the route to the device before the ASA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.