We have several pairs of ASA5510s in failover A/P mode, some running 8.3(2) and others running 8.4(1).
e0/0 = outside
e0/1 = inside
m0/0 = management
The problem we're having is we can't get anything to route out of the management interface unless we put in a static route at least to the subnet level. For example, we want syslog traffic to exit out m0/0 to our syslog server 10.71.211.79. Our 'gateway of last resort' points to the next hop out e0/0, and a second static route with a higher metric and a more distinct network space is for m0/0 as in:
route outside 0.0.0.0 0.0.0.0 192.168.49.129 1
route management 10.72.0.0 255.255.0.0 10.72.232.94 10
This doesn't work, and ASDM loggin gives this error:
".....Routing failed to locate next hop for udp from NP Identity Ifc:10.72.232.89/514 to management:10.72.211.79/514"
If I put in a more granular subnet route, or a host route of the syslog server it works, such as:
route management 10.72.211.0 255.255.255.0 10.72.232.94 10 <------------- this works
route management 10.72.211.79 255.255.255.255 10.72.232.94 10 <------------- this works too
Why won't a static route for 10.71.0.0 255.255.0.0 work in this case?
We are going to have numerous hosts access and be sent messages though the management interface of these ASAs, and it would be very burdonsome to have to add a host, or even a subnet, route for every one. I've removed all static routes and tried to rely on EIGRP, but that doesn't work. I also had to put 'passive-interface management' under the EIGRP for this to work.
Here is the pertinant ASA config concerning syslog, routing, and interfaces:
interface Ethernet0/0
nameif outside
security-level 0
ip address 192.168.49.140 255.255.255.128 standby 192.168.49.141
!
interface Ethernet0/1
nameif inside
security-level 100
ip address xxx.xxx.xxx.xxx 255.255.255.128 standby xxx.xxx.xxx.xxx
!
interface Management0/0
nameif management
security-level 100
ip address 10.72.232.89 255.255.255.248 standby 10.72.232.90
management-only
logging enable
logging timestamp
logging trap informational
logging asdm informational
logging host management 10.72.211.79
router eigrp 1
no auto-summary
network 10.72.0.0 255.255.0.0
network xxx.xxx.0.0 255.255.0.0
passive-interface management
route outside 0.0.0.0 0.0.0.0 192.168.49.129 1
route management 10.72.0.0 255.255.0.0 10.72.232.94 10 <-------- this alone does not work
route management 10.72.211.79 255.255.255.255 10.72.232.94 10 <------- adding this host route works
http server enable
http 192.168.0.0 255.255.0.0 outside
http 10.72.0.0 255.255.0.0 management
