ip route doesn't work in ASA  !!

Posted on 2011-10-12
Last Modified: 2012-05-12
Dear I have this network diagram

from pc ( can ping to (dmz firewall) and pc can ping to

But pc cannot ping to ip or

I think need add access or nat to permit plz send to me this config

Note :-

from firewall can ping to both ips and
Question by:memo12345678

    Expert Comment

    Firewall cannot route the trafic within the same interface.

    You must add a route on the host with the gateway for the destination or set the default gateway on the host
    LVL 35

    Expert Comment

    by:Ernie Beek
    As a matter of fact you can let the firewall route that. But that's not the best way to do it (it's still a firewall, not a router).
    As fwed29 said, best thing is to add a route on the host: route add -p mask

    Or, if you're using dhcp, add a route through there.

    Expert Comment

    I'm not very agree because ASA can't route this trafic at all because both network are under the same inerface of ASA.

    You can ping with the icmp redirect but you can't establish connection du to asymmetric routing.

    The best solution, for me, is to use the router as gateway and add a route ANY to the ASA :

    If it's a Cisco router : ip route

    The network will be directly connected and known by the router.

    As said erniebeek, just change the gateway on the DHCP server :)

    The solution to add a route on the host will work but is not the best ... and you must do the same thing on all your host.
    LVL 35

    Assisted Solution

    by:Ernie Beek
    @fwed29: ever heard of: same-security-traffic permit intra-interface ?
    LVL 35

    Expert Comment

    by:Ernie Beek
    So it is possible but not optimal :)

    Accepted Solution

    @erniebeek : Yes, of course :) But you need more modification.

    Always the same problem : asymmetric routing

    The ASA will forward the trafic but the router will reply directly to your host :

    Host#1 -> ASA (Gw) -> Router -> Host#2 -> Router -> Host#1

    and not

    Host#1 -> ASA (Gw) -> Router -> Host#2 -> Router -> ASA(gw) -> Host#1

    Because the router and the ASA are on the same subnet ;)
    LVL 35

    Assisted Solution

    by:Ernie Beek
    Ah that part.
    I thought you were aiming at the impossibility to route out the same interface on the asa. Got lost in translation there :(
    Point taken.

    Author Closing Comment

    thx for bothhhhhh

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
    Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now