02-28-2023
10:10 AM
- last edited on
03-02-2023
01:06 AM
by
Translator
Hello.
Three ASAs at different office branches have routing configurations that are intended to have identical structural logic.
Most have this config...
ASA-5525-1# sh route
Gateway of last resort is 1.1.1.1 to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [1/0] via 1.1.1.1, outside
!! This is the route to the www. !!
---
Device config for deviating device...
ASA-5525-33# sh route
Gateway of last resort is 2.2.2.2 to network 0.0.0.0
D*EX 0.0.0.0 0.0.0.0 [170/51712] via 2.2.2.2
!! This is the route to the www. !!
Clearly the second device does not have a
default-static
route, but a redistributed default route.
Questions:
1. What is one scenario in which it would be advantageous to deviate from the first config (as did the second config)?
2. In the above situation, what could be the adverse result of the deviating config on
ASA-5525-33
?
Thank you.
Solved! Go to Solution.
03-01-2023 07:47 AM
This is an interesting question. For your standard with static default route I would suggest that the advantage is that it is not dependent on anything else. It will forward traffic outbound (and without the overhead of learning the default route via a dynamic routing protocol). The disadvantage of this is that if there is some issue with the upstream device (ISP etc) the ASA will continue to forward all traffic outbound (into a black hole).
The other situation is that the ASA has learned its default route via a dynamic routing protocol. Perhaps the disadvantage is the overhead of running the routing protocol. But the advantage is clearly that if there is some problem upstream that you will not forward traffic into a black hole.
03-01-2023 07:47 AM
This is an interesting question. For your standard with static default route I would suggest that the advantage is that it is not dependent on anything else. It will forward traffic outbound (and without the overhead of learning the default route via a dynamic routing protocol). The disadvantage of this is that if there is some issue with the upstream device (ISP etc) the ASA will continue to forward all traffic outbound (into a black hole).
The other situation is that the ASA has learned its default route via a dynamic routing protocol. Perhaps the disadvantage is the overhead of running the routing protocol. But the advantage is clearly that if there is some problem upstream that you will not forward traffic into a black hole.
03-01-2023 08:02 AM
In addition to what Rick describes, a default route via a routing protocol may change dynamically to a better egress interface.
Also in case where there cannot be a better path, a dynamic default route can drop packets much sooner, perhaps even at the gateway device.
Basically pros and cons are much like doing any routing static vs. dynamic, both work and they're not mutually exclusive.
03-01-2023 08:02 AM - edited 03-01-2023 08:45 AM
...
03-02-2023 01:09 PM
I am glad that our suggestions have been helpful. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide