topic Cisco ASA Question re Route Maps in Network Security

Cisco ASA Question re Route Maps

MattMH — Fri, 05 Jan 2024 15:33:12 GMT

Would someone mind helping me determine what the purpose of a config like this is doing on a Cisco ASA? I am inheriting an ASA environment that has not been audited in years, is my assumption.

I see a route-map that is matching on an ACL, LAN-DMZ-ACL. The route map is then using a Policy Based Routing configuration that sets the Interface to Inside-LAN.

The LAN-DMZ-ACL has 2 objects. A /16 network and a /24 network. The /16 network is our user network and the /24 is a VPN network.

I do not understand why traffic from these 2 objects has a PBR that sets the interface to Inside-LAN bc the /16 and /24 objects are already coming from the Inside-LAN interface source.

We have 10+ route maps setup the same way. Maybe this is typical of an ASA Fw deployment, but its not making sense to me.

If I look at some docs, I see...
specify the egress interface for a route but not necessarily to set a specific outgoing interface.

Wouldnt the routing on the ASA handle this?

TIA

Re: Cisco ASA Question re Route Maps

MHM Cisco World — Fri, 05 Jan 2024 16:27:24 GMT

You are correct
Yes it should be
MHM

Re: Cisco ASA Question re Route Maps

MHM Cisco World — Fri, 05 Jan 2024 18:59:27 GMT

can you check if this PBR is apply to interface or not

MHM

Re: Cisco ASA Question re Route Maps

MattMH — Fri, 05 Jan 2024 19:06:24 GMT

Yes, I did see that it is.

Whoever set this up, seems like they were trying to do routing with it, vs just simply using routes. I ran into this issue bc I was trying to create a new static route and it wasn't working. I am pretty sure PBR's are priority over routes.

Re: Cisco ASA Question re Route Maps

MHM Cisco World — Fri, 05 Jan 2024 19:15:20 GMT

there is one case
when the DMZ and INside share same subnet (supernet) when the interface is flapping then the RIB will forward the traffic via wrong interface and if traffic is UDP then you will face issue in traffic
the solution is timeout floating-conn but I think your team use PBR instead to be sure that the traffic always direct to correct interface.

MHM