Route issues with Cisco ASA5505

Posted on 2014-08-20
Last Modified: 2014-09-10
I have a Cisco ASA 5505 with a pretty simple configuration.  It's got a single site-to-site vpn, default route out for internet traffic.  But I also have 5 static routes to direct certain subnets to another firewall on the inside network.

The problem is that the last 3 mornings, traffic to those 5 subnets has quit working.  It works again after restarting the ASA.  I wondered if the ASA was learning routes from another device on the network, but can't find any route-cache settings to change on the ASA.

What could cause this?
Question by:bunchageeks
    LVL 9

    Expert Comment

    It would be hard to say but a few things I would like to ask.

    1. Are you running any dynamic routing protocol on the ASA?
    2. On the VPN configuration, is reverse route injection configured?
    3. During issue, if the ASA accessible via SSH? When accessed, what is the result of the tracert or show route, does it change from stable conditions?
    4. During issue, are all interfaces up especially the interfaces connecting to the next-hop on the inside.
    5. Are your static routes on the ASA directed to a Virtual IP (VIP) of a FHRP (HSRP,VRRP,GLBP) by any chance? During issue is the next-hop pingable from the firewall?
    LVL 9

    Expert Comment

    also I forgot to ask, are you running redundant ASA actve-standby?

    Author Comment

    Thanks.  I'll answer what I can:

    1. no
    2. no
    3. yes.  Haven't done tracert, show route looks normal
    4. yes
    5. no, and yes
    Active Standby?  no
    LVL 9

    Assisted Solution

    So a few things I would have suspected at first.

    if on active-standby (which is not the case), the ASA switches over to the standby ASA but the link going from the firewall to the internal network is on a blocking state (STP).

    ASA memory or CPU is overload, but very unlikely since you are able to access it.

    The next-hop is not reachable, but like you said you where able to ping the next-hop. So next time issue occurs, it might be good troubleshooting to check the route via tracert to verify which part of the network you are not reaching.

    When you say traffic to those 5 subnets, did you mean traffic incoming from VPN towards those 5 internal subnets? It might not be a routing issue but rather VPN tunnel is down. You can check via show command "show isakmp sa"

    If the VPN tunnel is down, it might be a mismatch on the VPN configuration between the sites. You can restart the VPN tunnel and not reboot the ASA via "clear ipsec sa peer x.x.x.x"

    Sorry I couldn't be more specific, but those are the few things I'd check when issue arise again.

    Hope this helps.

    Author Comment


    This morning I was set for troubleshooting but so far, the issue hasn't come up.  

    Yesterday I only had a couple of minutes to look at the issue.  Then I had to reboot to fix it and leave for an appt.  All I found yesterday was that from the ASA, the routing table was correct, and I could ping an IP on the subnet that was supposedly down.  I didn't get a chance to try traceroutes, etc.  Hopefully if this happens again, I'll have more time to dig in and troubleshoot.

    Accepted Solution

    Well, this hasn't happened again and it's been 2 weeks.  I wasn't able to find an issue with the ASA.  I am going to assume it was a problem with the part of the network I don't administer.  Thanks for the suggestions and help.

    Author Closing Comment

    I am only including my own comment as partial solution because it appears the problem wasn't with this ASA after all.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    This article is focussed on erradicating the confusion with slash notations. This article will help you identify and understand the purpose and use of slash notations. A deep understanding of this will help you identify networks quicker especially w…
    Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now