We help IT Professionals succeed at work.

Cisco ASA 5505 static route problem

NewDawn asked
Medium Priority
Last Modified: 2012-06-27
I just replaced an old linksys wrt54G router/wireless access point with a new ASA 5505 for a new client.

Everything is working fine except I am unable to get it to route to a remote subnet that is connect through a Point-to-Point T1 with a pair of Cisco 1721 routers

The network is setup like this

Main office
main office Cisco 1721

remote office
remote office Cisco 1721

ASA 5505 Local IP

The computers in the office all have a default gateway of
If I statically create the route on the workstations "route add mask" An individual workstation is able to connect to the remote subnet

I am also able to ping the remote subnet from the ASA.

The only thing I cannot get to work is for the ASA to route the request to the Cisco 1721 properly. The remote office is completely down at this point as their Phones and internet access all come from the main office.  Any help would be greatly appreciated.

Here is the current running config.

ciscoasa# show run
: Saved
ASA Version 7.2(4)
hostname ciscoasa
domain-name ******************
enable password rafexqUfMM0XEGAi encrypted
passwd rafexqUfMM0XEGAi encrypted
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif outside
 security-level 0
 ip address **************
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address dhcp
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
dns server-group DefaultDNS
 domain-name ******************
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list inside_nat0_outbound extended permit ip
access-list outside_access_in_1 extended permit tcp any host ************** eq 3389
access-list outside_access_in_1 extended permit tcp any host ************** eq telnet
access-list outside_access_in_1 extended permit icmp any any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1
static (inside,outside) tcp interface 3389 3389 netmask
access-group outside_access_in_1 in interface outside
route inside 1
route outside ************** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet inside
telnet outside
telnet timeout 10
ssh inside
ssh outside
ssh timeout 10
console timeout 0
dhcpd auto_config outside

username ******** password EqL7qWUK0pIRfrNh encrypted privilege 15
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect pptp
service-policy global_policy global
prompt hostname context
: end
Watch Question

The default route on the ASA is pointing to some public IP

route outside ************** 1

not the next hop router that can reach that specific subnet (next hop

Thus, the asa is sending all traffic it receives to the public IP, and not to the correct router.

if you add this statement to the asa, it may work.

ip route

This is not best practice though.  The ASA should be between the router and the internet, and your clients should point their default gateway at the router.  

Either way, this definitely makes sense why your clients can't get to that subnet when pointed at the asa, but can when pointed at the edge routers.


I agree that the client should separate any routing from the firewall, but considering what this is replacing this is a big step in the right direction.

I tried adding the command to the ASA and it is failing.  If I understand it correctly (and I am obviously missing something because it is not working) these two commands are supposed to make it so that the ASA will disregard NAT on that subnet.

nat (inside) 0 access-list inside_nat0_outbound
access-list inside_nat0_outbound extended permit ip

Then since it is not NAT'ing it should send it to the only route available.

route inside 1

that one.  

And yes, any of the ********** ip addresses have been replaced for security purposes.  
I have encountered a similar scenario in the past.  The ASA is not going to do what you want it to do, because it is not a router.  Think of it as more of a l2 pass-through with l3+ capabilities.  That is why I added the statement "it may work."  I did not notice the route inside statement before.

You are correct with that no nat access list.  That is what excludes that traffic from being handled by NAT.

You are going to need to put a router between the asa and the internet if you want this to work.  The ASA just can't do it.

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Cyclops3590Sr Software Engineer
this won't work by Cisco firewall design.  Packets can't go in and out the same interface.  What you are trying to do is have the workstations use the ASA as the default gateway.  Then have the ASA forward packets it received on its inside interface, back out its inside interface to the 1721 router; which is illegal on a Cisco firewall.

What you need to do is configure the 1721 router at as the default gateway.  And then have a default route on it be the ASA inside of
If you you only want the 60 network to use the ASA as the default gateway you can use a route-map as well.


I was hoping that would not be the case, but oh well.  I will have to run password recovery on the Cisco 1721 (they lost the password)  but I will get that going and make it work.  Thanks for you help guys.

Klinko2k was the first with the answer so I will award him the majority of the points.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.