SA 500 Series Static Route Question

Can you enter a static route to go out a specific interface rather than an IP?
Example:
172.16.1.1 ---> WAN1
172.16.100.1 ---> WAN2
Can this be accomplished?

See that's where it gets a little fuzzy.
The 172.16.x.x address's exist on modems on the WAN side.
The actual WAN (or gateway in this case) IPs on the modems are dynamic so I really don't want to specify a fixed IP for the "gateway".
Really, if it just went out WAN1 or WAN2 the appropriate modem would pick it up.
How would I accomplish this?
Would I give it Quad Z's or something like that?

Similar Messages

RV042 Static Routing Question

I am currently using RV042 in the two-WAN backup mode. However, I tried the redundant option and am finding it to give me more bandwidth and better performance than only one of the WANs.
My problem is that in the redundant mode, I am unable to use a few websites that I use on a regular basis. One of the sites is our internet hosted time sheet service and their site just goes crazy when I try to access it through the router set up in redundant mode. I am not even able to login to their site, and it is important for my daily work.
My question is - can I set up static routes for certain sites so that the router knows to access them through only one of my WANs? For example, if my timesheet software site is 123.123.123.123, and my prefered WAN gateway is 68.68.68.68, can I tell the router to only access this site through the given gateway, even if the router is configured to use either WAN?
I have tried static routes and it does not seem to work at all.
For example:
Site: 123.123.123.123
SM: 255.255.255.0
Gateway 68.68.68.68
When I save this and run the tracert to 123.123.123.123, it goes through the other gateway, and not the one I specified here.
Any hints are appreciated.
Thanks,
Alex P.

If your using this in load balance mode, go to system management and scroll down to protocol binding. Chances are your going to a secure site with both wans working and the site sees one connection with two ip addresses coming at it and breaks the connection. You can do a protocol bind for all your https traffic to go out one wan for all the ip addresses in your network and this should fix the issue. You can do this for mail and other protocols that would get messed up by the dual wan. Hope this helps.

Cisco ISA 500 Series - Intervlan routing via 801.2q (Router on a stick)

Hello to everyone,
I am considering the ISA 550 for a customer who has multiple VLANs on his network. In order to avoid purchase a layer3 switch, I was thinking that we could perhaps create a 802.1q trunk link from a switch to the ISA500 and perform Inter-VLAN routing through that. In addition, we would use access lists to prevent communications between specific VLANs.
My question is if this setup model can be done on the ISA 550. I haven't used it before, so I am not sure if it can support this setup.
Any information or help is much appreciated.
Many thanks,
Chris.

Chris, ISA550 can support the configuration you described.

I´m doing a design for presale, where I will need a router what support PAT for 500 or a little more of users, it not need any more features only static routing and dhcp pool for 500 users, can you help me for know what router recommend?

I´m doing a design for presale, where I will need a router what support PAT for 500 or a little more of users, it not need any more features only static routing and dhcp pool for 500 users, can you help me for know what router recommend?

What is your WAN speed currently and projected WAN speed in the next 3 years?

SGE2000/P Static Routing (equals L2+) Explain?

What does L2+ mean? I realize these aren't L3 switches with SVI capabilities, so what is the purpose of configuring static routes if there is no InterVLAN routing capability?
T.I.A.,
Chris

Welcome to Cisco Community!
With out getting into a huge discussion I will try to answer as quickly and directly as possible.
Our SFE and SGE series switches are Layer 3 switches (can also be configured as L2) so they are able to perform as a (inter VLAN) router or gateway for all VLANs. Once you have created the VLANs and assigned each an IP address, that IP address will become the GW for that VLAN. Under Routing you will not see any learned networks until you assign the VLAN to a port and the port becomes active. You will then need to configure a default route to send the traffic out to the cloud. The router will need to belong to the same VLAN as the switch. So if the switch has an IP address of 172.16.30.1/24, the router will have an IP of 172.16.30.254/24 for example. The route would read like this: 0.0.0.0/0 next hop 172.16.30.254 metric 2 (or higher).
As for static routes as a L2 or L3 switch, they would be useful when you have a device attached to another switch which is disjoined from your typical network on the local switch. In other words, lets say you have 3 (aside from default native VLAN 1) VLANs V10 - 30. All you of your devices belong to these VLANs but you have a server on VLAN 30 which is not connected to this switch. You will then create a static route for that server's IP address to the remote switch.
VLAN30: 172.16.30.1 (local SGE)
Server: 172.16.30.200 (on remote switch)
Remote Switch: 192.168.20.1 (remote SGE)
VLAN30: 172.16.30.2 (on remote SGE)
Static Route:
destination 172.16.30.200 next hop 172.16.30.2 metric 2
I hope this answers your question. These are really my favorite switches, as I find them very reliable and highly configurable. I love these things.

In A Perfect World - Using Static Routes In RRAS 2012 To Traverse Sites

I have site-to-site VPN tunnels between my main sites
NYC <--> UK
NYC <----> SANFRAN
NYC <----> BOSTON
NYC <----> MALTA
UK <----> SANFRAN
UK <----> BOSTON
And could see ALL sites when I had my DA/RRAS server using one of the existing subnets (for example, when I used US VPN on NYC DHCP (192.168.2.x) I was able to see EVERYTHING on any site we had a site-to-site VPN with (i.e. from VPN client I could access
MALTA, UK, SANFRAN, BOSTON).
Alas I had to change that to a different subnet (192.168.145.x) and now only see the 192.168.2.x network in NYC.
Is there a way to add static routes on the NYC & UK DA/RRAS servers so this access is restored? Or would this be solved at the Layer 2/3 network level?
Michael P. O'Hara

No, you need to allow forwarding of broadcast packet, but it's really against the best-practice, as you can kill easilly your satellite link.
I agree with you for wins, as I personnaly does not use it and try to remove it when I see someone use it, but it's the only solution for what you want (network discovery over LAN). (even LLTD is not routable beyond router)
Editted: You need to see all machines, but does the enduser must see them ?
Regards, Philippe
Don't forget to mark as answer or vote as
helpful to help identify good information. ( linkedin endorsement never hurt too :o) )
Answer an interesting question ? Create a
wiki article about it!

Need Help for configuring Floating static route in My ASA.

Hi All,
I need your support for doing a floating static route in My ASA.
I have tried this last time but i was not able to make it. But this time i have to Finish it.
Please find our network Diagram and configuration of ASA
route outside 0.0.0.0 0.0.0.0 6.6.6.6 1 track 1
route outside 0.0.0.0 0.0.0.0 6.6.6.6 1
route rOutside 0.0.0.0 0.0.0.0 3.3.3.3 10
route inside 10.10.4.0 255.255.255.0 10.10.3.1 1
route inside 10.10.8.0 255.255.255.0 10.10.3.1 1
route inside 10.10.9.0 255.255.255.0 10.10.3.1 1
route inside 10.10.15.0 255.255.255.0 10.10.3.1 1
route rOutside x.x.x.x 255.255.255.255 5.5.5.5 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.10.3.77 255.255.255.255 inside
http 10.10.8.157 255.255.255.255 inside
http 10.10.3.59 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 123
type echo protocol ipIcmpEcho 8.8.8.8 interface outside
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
crypto ipsec transform-set cpa esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map vpn_cpa 1 match address acl_cpavpn
crypto map vpn_cpa 1 set peer a.a.a.a
crypto map vpn_cpa 1 set transform-set abc
crypto map vpn_cpa 1 set security-association lifetime seconds 3600
crypto map vpn_cpa interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
track 1 rtr 123 reachability
telnet 10.10.3.77 255.255.255.255 inside
telnet 10.10.8.157 255.255.255.255 inside
telnet 10.10.3.61 255.255.255.255 inside
telnet timeout 500
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.10.3.14
webvpn
tunnel-group .a.a.a.a ipsec-attributes
pre-shared-key *
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
smtp-server 10.10.5.11
prompt hostname context
Cryptochecksum:eea6e7b6efe5d1a180439658c3912942
: end
i think half of the configuration stil there in the ASA.
Diagram.
Thanks
Roopesh

You have missed the last command in your configuration, Please check it again
route ISP1 0.0.0.0 0.0.0.0 6.6.6.6 track 1
route ISP2 0.0.0.0 0.0.0.0 3.3.3.3
sla monitor 10
type echo protocol ipIcmpEcho 8.8.8.8 interface ISP1
num-packets 3
frequency 10
sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability
You can do NAT in same way, here the logical name of the interface will be different.
Share the result
Please rate any helpful posts.

Cisco UC560 Not Clearing Static Routes When VPN Connections Drop

We have a Cisco UC560 (UC560-FXO-K9) running "Cisco IOS Software, UC500 Software (UC500-ADVIPSERVICESK9-M),
Version 15.1(2)T2, RELEASE SOFTWARE (fc1)" The issue is when we have end users connecting with the Cisco VPN Client to this device sometimes we are unable to connect to any devices on our LAN or sometimes we can't connect to the LAN on the other end of our site-to-site VPN. The one symptom I've observed when this happens is that old VPN sessions that have disconnected appear to leave static routes from the user's outside IP at their home to an IP on our LAN to a Virtual-Access interface. When this starts to happen, I restart the firewall to clear out the stale static routes and the problem is fixed, for a while at least. Below is the current state where we have the site-to-site VPN connected to our branch office and 2 user's connected with Cisco VPN clients. Below that is the static route table which has 5 total Virtual-Access interface routes (one is an extra route for a user currently connected so that their outside IP is in the static route table with 2 inside IP's associated.) Is there a way to fix the cleanup of VPN connections when they terminate?
#sh crypto isakmp peers
Peer: <branch office outside IP> Port: 500 Local: <firewall's outside IP>
Phase1 id: <branch office outside IP>
Peer: <users's outside IP #1> Port: 50420 Local: <firewall's outside IP>
Phase1 id: EZVPN_GRP_437
Peer: <user's outside IP #2> Port: 49345 Local: <firewall's outside IP>
Phase1 id: EZVPN_GRP_437
Bugsy#sh ip ro st
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override
Gateway of last resort is <next hop of ISP for firewall> to network 0.0.0.0
S*    0.0.0.0/0 [1/0] via <next hop of ISP for firewall>
      10.0.0.0/8 is variably subnetted, 12 subnets, 3 masks
S        10.0.0.153/32 [1/0] via <non-connected IP of VPN user>, Virtual-Access2
S        10.0.0.155/32 [1/0] via <non-connected IP of VPN user>, Virtual-Access2
S        10.0.0.156/32 [1/0] via <user's outside IP #2>, Virtual-Access3
S        10.0.0.158/32 [1/0] via <user's outside IP #1>, Virtual-Access3
S        10.0.0.159/32 [1/0] via <user's outside IP #2 again>, Virtual-Access2
S        10.1.10.1/32 is directly connected, Vlan90

Hi Brian,
This sounds like you are running into the following known issue:
CSCtl03682 - EzVPN client: Several RRI routes pointing to same virtual interface
which is Dup'd to:
CSCtf39056 - RRI routes not deleted
This is fixed since 15.1(2)T4, so I would recommend upgrading to SWP 8.2 or higher. The only other way to clean up the stuck routes is to reload the router.
Thanks,
Brandon

Configuring Static Route Tracking Using ASDM 7.1(3) ASA 9.1(2)

I have recently updated my ASA5520 to 9.1(2) and I am using ASDM 7.1(3) to configure Static Route Tracking. I have done this previoussy in earlier version of ASDM without a problem. There seems to be a new field in the Tracked Options section. What is the "Target Interface"? Is it the interface I want to use as the standby route when the Monitor fails? Or is it the Interface that is doing the monitoring?
I have looked through Cisco ASA Series General Operations ASDM Configuration Guide Software Version 7.1, as well as older ASDM books and this field is never listed or described.

Hi,
The target interface will be the interface through which you will be polling some destination IP address with ICMP Echos to determine if the route through that interface is still valid.
So in your case you would use "Outside"
Heres the link to the ASA Command Reference listing the above "type" command under the "sla monitor 1" configuration
http://www.cisco.com/en/US/docs/security/asa/command-reference/t2.html#wp1568359
- Jouni

How to erase all configuration in Cisco ESW 500 Series Switches

Hi anybody,
Anyone show me how to erase or remove configuration file from ESW 500 Series Switches?
Thanks
Thuc

Hi Thuc,
The restart / reset function will allow for local or remote reset of the the unit to Factory defaults, see screen capture below. ;
Alternatively, the Switch can be reset by inserting a paper clip into the RESET opening on the friont of the switch.
Pressing the manual reset for 0 to 10 seconds only reboots the switch.
Pressing the manual reset for longer than 10 seconds results in the switch being reset to factory defaults.
does this answer your question, not exactly sure it does ?
regards Dave

Persistent Static Routes

I have three Macs that need to have persistent static routes set up. I installed RouteSplit for this purpose and it seems to work well. After reboot, I can ping a host machine on the static route. But if I try to mount an SMB share over that route, it fails and I find that I can't even ping the host address anymore. If I reboot, I am back to having connectivity again, but attempting to mount the SMB share breaks it again. Is there something in the SMB.conf file that is breaking my static route?
By the way, even after it has been broken, I can do a netstat -rn and it shows the static route in the routing table. I am lost.
Bob Reed

I can ping a host machine on the static route
By name, or by address?
But if I try to mount an SMB share over that route, it fails and I find that I can't even ping the host address anymore
By name, or by address?
You don't state how you're testing your ping, either before or after the attempt to mount the server.
There is a 100% disconnect between SMB and your routing table - it shouldn't be possible for SMB to affect that, nor should SMB care how to get to the specified host. Therefore I'm thinking the problem lies somewhere in between, possibly in the name resolution part of the process, hence my questions.

Multiple instances of EIGRP or static routes

I'm building a network which needs to have All but one of it's private networks pass through a DMVPN, all the routes are advertised through EIGRP, that part works great!
I have a private VLAN that only has access onto the internet, the address is Nat'ed over to a public IP address. Each router, there's six of them, are neighbors to two other routers. The furthest router to the internet has to go through three routers to get to the internet. My current idea is to use static routes on all the routers to the Internet gateway router. Then let recursive routing sort out each hop. What I would rather do is have EIGRP do all that. I really don't want to mess with the EIGRP that's running for the DMVPN tunnels, I'd like to have another instance of EIGRP run on the routers that will route the users to the Internet.
Does anyone have any thoughts concerning this design.
Thanks.
Mitch

Mitch
I am not clear about what you are attempting to achieve and not very clear about the topology. So my answer may or may not be on target. If it is not perhaps you can help us understand a little better what is involved.
I believe that what you are saying is that you have an existing network with multiple locations connected over DMVPN and that you run EIGRP as the routing protocol for that network. I believe you are also saying that there is one network segment which needs access to the Internet but should not be able to access the other parts of your network.
You say that the address of this other segment is NATed but are not clear whether the translation is ont the router where the segment is located or is on the Internet gateway router.
Probably the traditional solution for this would be to provide a default route for this segment pointing toward the Internet gateway router, to have a route on the Internet gateway router (and other routers along the path toward where the network is located), and a series of access lists on each router along the way which allows passage to the Internet and denies access to local resources.
I would propose a somewhat different solution. I believe that it would work if you configure a GRE tunnel between the router where the segment is located and the Internet Gateway router. On the router where the segment is located you could do Policy Based Routing to send traffic from the private segment to the Internet over the GRE tunnel (which effectively isolates it from your other resources). You might want Policy Based Routing on the Internet gateway router to be sure that traffic from the private segment was forwarded only to the Internet (though you might not need that). The Internet gateway router could have a route (probably a static route) which sends traffic to the private segment over the GRE tunnel.
Let us know what you think of this. And if it is off the mark perhaps you could clarify a bit.
HTH
Rick

Two quick VLAN routing questions

lets say I have a L3 switch routing 4 VLANs
VLAN 1 is 192.168.10.0/24, the switch's virtual interface is 192.168.10.254 inside this vlan
VLAN 2 is 192.168.20.0/24, the switch's virtual interface is 192.168.20.254 inside this vlan
VLAN 3 is 192.168.30.0/24, the switch's virtual interface is 192.168.30.254 inside this vlan
VLAN 4 is 192.168.40.0/24, the switch's virtual interface is 192.168.40.254 inside this vlan
there is only one router going out from this switch to the net, and lets say it is in VLAN 1 and it's address is 192.168.10.1
first question-- inside of the L3 switch I will need to add a default route of 0.0.0.0 0.0.0.0 192.168.10.1
so that all traffic not corresponding to a 192.168.x.x address knows where to get out to the net, correct?
secondly- when configuring that router, is there a difference if I use the following static route:
192.168.20.0 255.255.255.0 192.168.10.254
instead of
192.168.20.0 255.255.255.0 192.168.20.254
either way, the packet gets to the L3 switch, but in one case it gets there via the VLAN interface inside of VLAN 1, and in the other case, it gets there via the VLAN interface inside of the VLAN for which the traffic is destined anyway. what im trying to figure out is, will this make any difference at all? especially in terms of broadcast packets?
if it makes no difference, then is it safe to say that the following static route would be optimal?
192.168.0.0 255.255.0.0 192.168.10.254
Solved!
Go to Solution.

Re "firstly". Correct. The L3 switch will route traffic according to its routing table. By default it knows all IP subnets to which it is directly connected to, i.e. all the VLAN subnets. If you have to add a default route manually or not depends on the exact implementation. It may well be that the L3 switch will use the any default gateway for routing which you use for the IP settings of the switch itself (if there is an option in the web interface to set a default gateway). If you cannot define a default gateway on the L3 switch you probably have to add a static route manually. The easiest way should be to check the current routing table and see if there is a default gateway or not.
Re "secondly". A router can only forward packets to the next hop router. The next hop router must be connected to that router. The route "192.168.20.0 255.255.255.0 192.168.10.254" is correct for a router with IP address 192.168.10.1 and subnet mask 255.255.255.0 as 192.168.10.254 is connected to the router. "192.168.20.0 255.255.255.0 192.168.20.254" is not correct. The router cannot learn the path to a specific subnet 192.168.20.0/255.255.255.0 by using a gateway in that subnet. It is not correct to use that kind of a route and you should not use it even if it might even work (because the router does a plain ARP request to find the MAC address of 192.168.20.254 and your L3 switch will respond to the ARP request even if it is on the internet of 192.168.10.254). The very moment when there would be another router between the 10 and 20 subnets it would not work anymore...
Re your conclusion: I would recommend to keep four static routes for the existing subnets on the L3 switch instead of putting everything into a larger single subnet which includes a lot of addresses which are not connected there. Technically it works if you only use working IP addresses. But you will see some loops if you send something to 192.168.55.50 or similar. The gateway router will send it to the L3 switch which will send it back to the gateway. They should figure it's a loop but still I would not recommend this kind of setup... Add routes for each of the L3 switch subnet...

Help with RV042 Static Routing

I just purchased an RV042 Dual WAN Router. Both WAN's are connected from different ISP's. I have a PBX phone server connected to this router and want all traffic to and from this phone server going out strictly on one WAN and all the computers and the rest of the traffic on the other WAN. If I understand correctly, this needs to be set up in static routes? If that's the case, how would I do that? If not, the question still stands. Please help.

Hello Vitaly,
What you are looking for is Protocol Binding. By setting this up you will be able to control what traffic goes out which WAN port. Protocol Binding can be done for certain traffic types or for certain IP addressess.

Is Static Routing Necessary?

I'd like to use an 1812 to route data between 2 subnets (say 10.1.1.x and 11.1.1.x). I'm setting up the two WAN interfaces (FastEthernet0 and FastEthernet1) with IP addresses and subnet masks for each of the two subnets.
Will traffic heading from the 10.1.1.x subnet and destined for the 11.1.1.x subnet automatically route correctly (and vice-versa), or will I need to configure static routing?
Also, a follow-up question. If I'm only expecting traffic from one of the subnets and destined to the other (either 10.1.1.x to 11.1.1.x, or vice-versa), do I need to configure a default route? If no default route is configured, what happens if a packet comes in destined for an unknown subnet?

Trevor
In the situation which you describe where the router has 2 interfaces and networks are configured on each interface, then you do not need static routing to route between those networks.
In this situation I do not see any reason to configure a default route. The default route is certainly not needed to route between those networks. And if a packet came into the router and the destination were on some network not connected to the router, what could you do? Do you have any way to forward packets to any other network? As you describe it there is no benefit for a default route. And in this situation if a packet did come in with a destination for an unknown subnet, then the only thing that the router can do is to drop the packet.
HTH
Rick

SA 500 Series Static Route Question

Similar Messages

Maybe you are looking for