topic Re: ASA Default Route Configuration in Network Security

ASA Default Route Configuration

Waterbird — Fri, 21 Feb 2020 16:31:50 GMT

I'm using an ASA 5506-X

I decided to go with a static default route in my configuration

I'm not connected yet to the internet, but I assume that is not necessary for configuration.

My understanding is the default static route configuration on an ASA is like this:

route outside 0.0.0.0 0.0.0.0 x.x.x.x

or simply:

route outside 0 0 x.x.x.x

(where x.x.x.x is the next hop, i.e the ISP router)

The commands are entered, and the route shows up on show run route, so all seems fine.

However, when I issue the show route command, and view the routing table, it still says gateway of last resort is not set.

Re: ASA Default Route Configuration

balaji.bandi — Fri, 30 Nov 2018 22:49:12 GMT

route outside 0.0.0.0 0.0.0.0 x.x.x.x - is the right command

but do you have outside interface configured and connected ?

Re: ASA Default Route Configuration

Rob Ingram — Fri, 30 Nov 2018 22:52:07 GMT

Hi,
You'd normally see this if the interface was down. Is the interface shutdown?

HTH

Re: ASA Default Route Configuration

Waterbird — Fri, 30 Nov 2018 23:21:29 GMT

It is not administratively down. It is down/down only because it's not connected to anything.

Re: ASA Default Route Configuration

balaji.bandi — Fri, 30 Nov 2018 23:30:07 GMT

You need to connect and test it.

Re: ASA Default Route Configuration

Rob Ingram — Fri, 30 Nov 2018 23:30:25 GMT

Whether shutdown or down/down it's the same outcome, try connecting it and ensure the interface is up. The default route should then be in the routing table.

Re: ASA Default Route Configuration

Waterbird — Fri, 30 Nov 2018 23:34:58 GMT

May I ask for the technical reason why that would be the case?

Why would the device not add a statically configured route to the routing table? It doesn't need to detect it as it would a directly connected route, or receive any routing updates to confirm. So I'm not seeing the technical reason it would not be in the routing table.

I want to be more confident that the configuration is done correctly before I take it to the site for installation.

Re: ASA Default Route Configuration

Rob Ingram — Fri, 30 Nov 2018 23:51:03 GMT

Reference doc here

"Static routes remain in the routing table even if the specified gateway becomes unavailable. If the specified gateway becomes unavailable, you need to remove the static route from the routing table manually. However, static routes are removed from the routing table if the specified interface goes down. They are reinstated when the interface comes back up. "

Plug the ASA into a switch, any switch, before taking it onsite and the default route should be added to the routing table once the interface is up.

HTH