topic Static Route Issue in ASA in Network Security

Static Route Issue in ASA

chaitanya_kodag — Tue, 12 Mar 2019 04:56:40 GMT

Hello Friends,

I am New to ASA world and need your help.I was working on a issue were we found that thier is one particular static route entry in ASA routing table.

We checked the running-configuration but did not find any entry in running-config for this particular route.It is an very specific route to host /32.I am not sure how that particular route is getting injected in ASA routing table.

This is a Multicontext firewall and route is seen one particular context and ASA IOS is 9.1. Can any one help me out here.

Thank you in Advance.

Hi, Well the best thing would

Jouni Forss — Thu, 16 Oct 2014 09:44:21 GMT

Hi,

Well the best thing would be to see some configurations and "show" command outputs to get a better picture of the problem.

Some route related problems before have been about not being able to remove a static route from the configuration but I am not sure if I have heard anything like this before.

The first thing that comes to my mind when a host route is found on ASA routing table with no related routing configuration that there is some VPN connection involved. VPN Client connections for example insert route for the VPN users IP address to the routing table for the duration of the connection. But as you say that you are running Multiple Context it cant be a case of VPN Client connection atleast.

Have you searched the configuration for any reference on the IP address in question? Is the IP address anywhere else on the ASA configurations?

But as I said, would be good to see some actual information from the device.

- Jouni

Thank you Jouni for your

chaitanya_kodag — Thu, 16 Oct 2014 13:57:30 GMT

Thank you Jouni for your reply,

You are correct their is vpn config involved in this.This is simple LAN to LAN IPSEC vpn and no client is involved.

I found a static route entry in the routing table

O 10.30.25.0 255.255.255.0 [110/90] via 10.10.19.2, 18:58:23, INSIDE

[110/90] via 10.10.19.1, 18:58:23, INSIDE

S 10.30.25.3 255.255.255.255 [1/0] via 199.99.25.83, OUTSIDE <====no config for this in running-config

Please let me know what show command output do you need to verify this.

Hi,I think if you are running

Vibhor Amrodia — Fri, 17 Oct 2014 10:39:43 GMT

Hi,

I think if you are running IPSEC L2L VPN , you must be running ASA 9.x.

Can you send the output of show run tunnel-group for this Tunnel and the related crypto acl? Also , show asp table routing from the ASA device.

Thanks and Regards,

Vibhor Amrodia