ASA Routes

[eric-owens]

HELP!

I've just inherited a network and I'm having issues with the ASA.  It is an ASA5540 configured with two outside interfaces.

GigabitEthernet0/0         unassigned        
GigabitEthernet0/0.3       x.x.x.A   
GigabitEthernet0/0.50      x.x.x.B   

x.x.x.A is a backup bonded t1 while x.x.x.B is a 200MBps FIOS connection.

My issue is that all outbound internet traffic is using x.x.x.A and not x.x.x.B.  Probably a very simple fix, but I'm afraid I'm going to break all kinds of NAT, VPN, etc.

By pasting in some of the configs, I'm hoping someone out there can help point me in the right direction to fix my wounded network.

route outside 0.0.0.0 0.0.0.0 x.x.x.A 1 track 1
route FIOS 0.0.0.0 0.0.0.0 x.x.x.B 250

global (outside) 1 interface
global (FIOS) 1 interface
nat (inside) 0 access-list NoNAT
nat (inside) 2 access-list MAILOUTNAT
nat (inside) 1 0.0.0.0 0.0.0.0

Gateway of last resort is x.x.x.A to network 0.0.0.0

S    192.168.40.0 255.255.255.0 [1/0] via x.x.x.A, outside
S    192.168.40.9 255.255.255.255 [1/0] via x.x.x.A, outside
S    192.168.40.10 255.255.255.255 [1/0] via x.x.x.A, outside
S    172.16.0.0 255.255.0.0 [1/0] via 10.111.252.5, inside
D    172.16.1.0 255.255.255.252 
           [90/2181376] via 10.111.252.5, 388:46:20, inside
D    172.16.1.2 255.255.255.255 
           [90/2181376] via 10.111.252.5, 388:46:20, inside
C    X.X.X.B 255.255.255.0 is directly connected, FIOS

.

.

S*   0.0.0.0 0.0.0.0 [1/0] via X.X.X.A, outside
S    192.168.0.0 255.255.0.0 [1/0] via 10.111.252.1, inside

Hopefully I've provided enough of the config to shine some light on the issue.  I really want outbound traffic to go to X.X.X.B instead of X.X.X.A network.

I see a SLA in place too, which I'm assuming is supposed to be used for a failover from X.X.X.B to X.X.X.A, but I don't think it's working, or maybe I don't fully understand how it's configured.

sla monitor 1
 type echo protocol ipIcmpEcho 4.2.2.1 interface outside
 frequency 10
sla monitor schedule 1 life forever start-time now

Anyways, if anyone out there could help out I'd be very very appreciative.

Thank you!

[Marvin Rhoads · Accepted solution]

You should also have a "track" statement in the configuration that ties the ip sla operation to the track object your desired default route is set to use. Something like:

    track 1 rtr 1 reachability

Without that, the preferred default route will not get a value for the tracked object and the backup route would kick in.

That aside, right now your statements:

route outside 0.0.0.0 0.0.0.0 x.x.x.A 1 track 1
route FIOS 0.0.0.0 0.0.0.0 x.x.x.B 250

...tell the ASA that as long as you can reach 4.2.2.1 to use the x.x.x.A default route. Only if the ip sla operation fails should you use the higher cost (AD 250) second static default route. If you want to reverse that setup then you would swap the bits following A and B in those statements.

If you're using VPN and NAT then, yes other things would change. Your VPN users would need to point to the FIOS-connected interface. Outbound dynamic NAT would also need to be setup to use that interface and any static NATs for incoming traffic would need to be modified/created as well.

[eric-owens]

Marvin,

You're awesome!  I do see that there is a track 1 rtr 1 reachability statement already included, just forgot to include that in my original post.

Sounds like I need to try flipping those route statements with B preferred unless track 1 fails, then route A would kick in.