Permanent route on Cisco ASA

[ms-tech-001]

Can I please know if there is anyway to make a permanent static route on cisco asa 5506x?  I am basically looking for a PPTPoE route to be available  in the routing table all the time so that my backup route won't get activated when there is some issue with the primary connection.

Thanks.

MS

[Dinesh Moudgil]

You can use metric to define the route to be chosen but once this is down, the other route (with higher metric) will take over.

Is there any specific reason you want to keep the backup route but not have it activated once the primary goes down ?

I'd suggest you have IP SLA setup to monitor ISP links
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118962-configure-asa-00.html

Regards
Dinesh Moudgil

P.S. Please rate helpful posts.

[ms-tech-001]

Thanks for the reply Dinesh. We have two ISP connected to our asa, one for general internet stuff and the second one dedicated to voip. We are using route-map to send the voip traffic to the backup connection. We thought about SLA monitoring but we have only base license. I believe that you need a security plus license to enable SLA? Also we noticed some issue with route-map when the backup connection become active and I think this issue will continue  even we proceed with SLA monitor. Our route-map acl has configured to permit only the  voip gateway to use the backup connection and this works fine when both connections are active but as soon as the primary route disappeared from the routing table all other devices will start to use the backup connection. Can I please know why this is happening and is there anyway to stop this. 

Thanks

MS

[Dinesh Moudgil]

One thing that you can try is to modify the access-list applied to PBR on 2nd ISP which is dedicated to voip gateway so that the data traffic is implicitly dropped due to deny in access-list.

Regards
Dinesh Moudgil

P.S. Please rate helpful posts.

[ms-tech-001]

Thanks Dinesh. I will try your suggestion. I was under impression that there is a an implicit deny  at the end of route-map acl. Do you know if SLA monitor requires a security plus license? I enabled the SLA monitor but the debugging not showing anything?

[Dinesh Moudgil]

The IP SLA Monitoring could be configured in all type of licenses, there are no specific requirements for this feature.

I doubt this is possible via PBR. Selective traffic propagation might not work as track will failover all the traffic. You might want to create an access-list entry for an access-list applied on ingress interface that will block your traffic which should not be allowed via second ISP.

Hope this helps.

Regards
Dinesh Moudgil

P.S. Please rate helpful posts.