Cisco ASA 5505 static route problem

Posted on 2009-02-17
Last Modified: 2012-06-27
I just replaced an old linksys wrt54G router/wireless access point with a new ASA 5505 for a new client.

Everything is working fine except I am unable to get it to route to a remote subnet that is connect through a Point-to-Point T1 with a pair of Cisco 1721 routers

The network is setup like this

Main office
main office Cisco 1721

remote office
remote office Cisco 1721

ASA 5505 Local IP

The computers in the office all have a default gateway of
If I statically create the route on the workstations "route add mask" An individual workstation is able to connect to the remote subnet

I am also able to ping the remote subnet from the ASA.

The only thing I cannot get to work is for the ASA to route the request to the Cisco 1721 properly. The remote office is completely down at this point as their Phones and internet access all come from the main office.  Any help would be greatly appreciated.

Here is the current running config.

ciscoasa# show run
: Saved
ASA Version 7.2(4)
hostname ciscoasa
domain-name ******************
enable password rafexqUfMM0XEGAi encrypted
passwd rafexqUfMM0XEGAi encrypted
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif outside
 security-level 0
 ip address **************
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address dhcp
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
dns server-group DefaultDNS
 domain-name ******************
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list inside_nat0_outbound extended permit ip
access-list outside_access_in_1 extended permit tcp any host ************** eq 3389
access-list outside_access_in_1 extended permit tcp any host ************** eq telnet
access-list outside_access_in_1 extended permit icmp any any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1
static (inside,outside) tcp interface 3389 3389 netmask
access-group outside_access_in_1 in interface outside
route inside 1
route outside ************** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet inside
telnet outside
telnet timeout 10
ssh inside
ssh outside
ssh timeout 10
console timeout 0
dhcpd auto_config outside

username ******** password EqL7qWUK0pIRfrNh encrypted privilege 15
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect pptp
service-policy global_policy global
prompt hostname context
: end
Question by:NewDawn
    LVL 4

    Expert Comment

    The default route on the ASA is pointing to some public IP

    route outside ************** 1

    not the next hop router that can reach that specific subnet (next hop

    Thus, the asa is sending all traffic it receives to the public IP, and not to the correct router.

    if you add this statement to the asa, it may work.

    ip route

    This is not best practice though.  The ASA should be between the router and the internet, and your clients should point their default gateway at the router.  

    Either way, this definitely makes sense why your clients can't get to that subnet when pointed at the asa, but can when pointed at the edge routers.


    Author Comment

    I agree that the client should separate any routing from the firewall, but considering what this is replacing this is a big step in the right direction.

    I tried adding the command to the ASA and it is failing.  If I understand it correctly (and I am obviously missing something because it is not working) these two commands are supposed to make it so that the ASA will disregard NAT on that subnet.

    nat (inside) 0 access-list inside_nat0_outbound
    access-list inside_nat0_outbound extended permit ip

    Then since it is not NAT'ing it should send it to the only route available.

    route inside 1

    that one.  

    And yes, any of the ********** ip addresses have been replaced for security purposes.  
    LVL 4

    Accepted Solution

    I have encountered a similar scenario in the past.  The ASA is not going to do what you want it to do, because it is not a router.  Think of it as more of a l2 pass-through with l3+ capabilities.  That is why I added the statement "it may work."  I did not notice the route inside statement before.

    You are correct with that no nat access list.  That is what excludes that traffic from being handled by NAT.

    You are going to need to put a router between the asa and the internet if you want this to work.  The ASA just can't do it.
    LVL 25

    Assisted Solution

    this won't work by Cisco firewall design.  Packets can't go in and out the same interface.  What you are trying to do is have the workstations use the ASA as the default gateway.  Then have the ASA forward packets it received on its inside interface, back out its inside interface to the 1721 router; which is illegal on a Cisco firewall.

    What you need to do is configure the 1721 router at as the default gateway.  And then have a default route on it be the ASA inside of
    If you you only want the 60 network to use the ASA as the default gateway you can use a route-map as well.

    Author Closing Comment

    I was hoping that would not be the case, but oh well.  I will have to run password recovery on the Cisco 1721 (they lost the password)  but I will get that going and make it work.  Thanks for you help guys.

    Klinko2k was the first with the answer so I will award him the majority of the points.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
    Broadband over Power Lines Broadband over Power Lines is the technology of transmitting computer data through power lines. This method of connectivity allows the user to have access to the internet without having to rely on additional cables, suc…
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…
    This video is in connection to the article "The case of a missing mobile phone (". It will help one to understand clearly the steps to track a lost android phone.

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now