We are in the process of replacing our firewall and are keeping the VPN client traffic on the older device. The public IP range is being split between the two devices from our border router. All the devices are Cisco. My question is given the setup below is there a better way to set the route statements?

I am going to change the PUB IPs to a RFC1918 range for this example.

physical connection --> edge switch, connecting: edge_router_inside_int01, edge_router_inside_int02, FW_old outside, FW_new outside

Range info:

config: edge_router_inside_int01: FW_old_outside:

edge_router_inside_int02: FW_New_Outside:

Route config:

ip route New_FW_outside
ip route New_FW_outside
ip route New_FW_outside
ip route New_FW_outside
ip route New_FW_outside
ip route Old_FW_outside

Is there a better way to abbreviate that?


You could consider prioritising the routes for the small portion like this. The tighter route will take precedence over the longer, so the priorities aren't strictly necessary but help explain the mechanism:

ip route   newfw 20
ip route oldfw 10

Perhaps with a device-of-death in case the link to oldfw goes down and you want to prevent the route to newfw: this does need a priority that's worse than the real route.

ip route null0 15
  • Longest match always wins, so metrics aren't necessary. Also, unless oldfw is on a physical interface that goes down, the loopback (did you mean null?) route will never replace the lower metric route.
    – Ricky
    Dec 21 '18 at 20:02
  • Thanks Ricky, I wasn't paying enough attention! Corrections made.
    – jonathanjo
    Dec 21 '18 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.