2

I should probably start by explaining the topography. We have two different Internet connections with separate firewalls. One is an ASA, and one is a Meraki. The default gateway for all the servers behind the firewalls is the ASA (10.100.200.1).

The problem I am having is that we have a site-to-site connection on the Meraki (10.100.200.2), and the traffic destined for the subnet (192.168.100.0) on the other side of the site-to-site connection can't find its way because it is trying to go through the ASA's default gateway (10.100.200.1).

If I set a static route on the server that is trying to send traffic to the subnet (192.168.100.0) to use the Meraki's default gateway (10.100.200.2), it works. How do I set a static route on the ASA so that any traffic that comes through the ASA uses the Meraki's default gateway to get out?

  • Might I suggest a picture of your topology? It will make it easier for us to provide assistance. – Eddie Apr 4 '16 at 20:20
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 7 '17 at 21:12
2

I see 2 possible solutions (apart from adding a router/l3 switch behind the ASA as Roy suggests in his answer):

  1. Configure a route on the ASA (as RonMaupin suggested). However, if the Meraki is on the inside of the ASA then this will require two more things in addition:

    • configure same-security-traffic permit intra-interface on the ASA, since the traffic will be entering and exiting the inside interface.
    • on the Meraki add a static route to the inside network, with the ASA as next hop. Otherwise you have asymmetric routing, the ASA will not see the return traffic and so TCP will not work (which could also be solved by some funky stuff on the ASA but it's ugly).
  2. Put the Meraki on a DMZ of the ASA

0

Did you try to set a static route on the ASA so that it sends any traffic destined for 192.168.100.0/24 to 10.100.200.2? Something like:

hostname(config)# route <if_name> <dest_ip> <mask> <gateway_ip> [distance]

Cisco has many documents explaining these things, just do a search..

  • Yes I have tried this and it still couldn't find its way. I can ping everything by ip and hostname from the 192.168.100.0 subnet but we have a sharepoint server that when you try to go to in browser it wont resolve. When I add a static route to the sharepoint server on top of the static route on the ASA it works. – llerdal Mar 5 '16 at 19:52
  • If the traffic is correctly routed when you use IP addresses, the routing and network is working correctly. A problem with a single server from a browser is a problem with protocol(s) above OSI layer-4, and it is off-topic here. You may want to ask about that on Server Fault. – Ron Maupin Mar 5 '16 at 21:07
0

Do not redirect from the ASA. The simple solution is to have a layer 3 switch whose IP address is the default gateway and can route traffic appropriately. An ASA is not a router.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.