ASA-5525: Why is Default Gateway different than S 0.0.0.0 0.0.0.0 ?

[jmaxwellUSAF]

Hello. GIVEN:

ASA-5525# sh ip route
!! output omitted !! Gateway of last resort is 3.3.3.3 to network 0.0.0.0

ASA-5525# sh route 172.16.239.0
% Subnet not in table
S 0.0.0.0 0.0.0.0 [255/0] via 172.16.7.1, inside tunneled

Why is the gateway of last resort different than the below route?

What is the next hop for standard traffic to reach 172.16.239.0 ?

Thank you.

[MHM Cisco World]

S 0.0.0.0 0.0.0.0 [255/0] via 172.16.7.1, inside tunneled <<- tunneled keyword make this Default GW use only by VPN anyconnect, remove it and check again 

[jmaxwellUSAF]

This is production environment. I think it is bad idea to remove this route.

My task involves routing endpoints through L2L tunnel. (The routing is not correct.)

Currently, what is the next hop for standard traffic to reach 172.16.239.0 ?

[MHM Cisco World]

S 0.0.0.0 0.0.0.0 [255/0] via 172.16.7.1, inside <<- then only add other static route. 
after you add above 
Currently, what is the next hop for standard traffic to reach 172.16.239.0 ? it will be 172.16.7.1 and egress interface will be INSIDE 

[jmaxwellUSAF]

OK, you solved my specific question. May you please now answer my general question?...

ASA-5525# sh ip route
!! output omitted !! Gateway of last resort is 3.3.3.3 to network 0.0.0.0

Why is the gateway of last resort different than the below route?

ASA-5525# sh route 172.16.239.0
% Subnet not in table
S 0.0.0.0 0.0.0.0 [255/0] via 172.16.7.1, inside tunneled

Thank you.

[David Ruess]

It looks like the AD is 255 (which means "infinite" metric) and do not install in routing table. So its probably using the 3.3.3.3 since it has a valid AD.

We would probably need the whole routing table to determine what decisions are being made.

-David

[jmaxwellUSAF]

Standard Cisco devices label AD 255 as infinite.

My understanding is that ASA devices are different-- they label AD 255 as valid.

Correct or not correct?

[David Ruess]

Apologies. You are correct. I overlooked that and don't work with ASAs like I do IOS devices. It was a habit response. 

[MHM Cisco World · Accepted solution]

Why is the gateway of last resort different than the below route? for your case you have already have another default gw toward 3.3.3.3, so no need another default route 

for point about if ASA can have two default route and which one will use it will use that without tunnelled for any traffic not from VPN. 

to be sure  run lab and always the ASA use the path toward the default gw WITHOUT TUNNELED 

and I also check the

show route x.x.x.x

<<- if the route not direct or static or dynamic learn then the ASA not show the default GW it use.