Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

We have a test environment which mimics our enterprise network security design. In this test environment my team and I would like to bypass our DMZ entirely. This seems easily enough done by simply changing the default route on our internal ASA (5510). The problem is that when using ASDM-IDM when I remove the old default route and create a new one it consistently will error out saying that there's a routing conflict. I'm not sure if this is a common mistake or if there is any guidance that you guys/gals can supply.

My next step is to manually change the default route via the console, but even if that works, I would still like to resolve this problem so we can use the GUI in the future.

Please let me know if there are any questions. Keep in mind that I have configured ASAs before and the current configuration is working correctly (its just points to a different gateway than we would like now). Also, i have double checked the routing on both the ASA and the device that the bypass (intended default route that is not working) is feeding to.

Additionally, I may need to look into version information.

-Ormis.

share|improve this question
This question looks like it might be better for Server Fault. There's not really any security content here; it's more about system administration and configuration. – D.W. Apr 8 '11 at 1:36
Agreed, i havent had a chance to look at it since sense i've been mucking around with an eljefe installation (FYI, it's an interesting tool by immunity immunity, but kind of clunky, if you want to look it up). If I continue to have issues I'll re-post to Server Fault. I just figured that Security Professionals would have the most knowledge when it comes to ASAs. – Ormis Apr 8 '11 at 13:36
Sorry for leaving this question idle for so long... I was able to get the default route to set properly when i pushed a good config to the ASA and then manually added the route via IOS... through I needed to get physical access to the appliance. – Ormis Jun 28 '11 at 18:06

2 Answers

up vote 0 down vote accepted

I don't regularly (or ever) use the IDM, but have you tried deleting the default route, pushing your changes, and then adding a new default route?

share|improve this answer
Yes I have tried that. I've even tried to do a configuration backup and then manually changing the configuration file in the backup. But it wouldn't accept my pushing the new configuration back through the GUI. – Ormis Apr 7 '11 at 11:44
@Ormis - can you list the actual commands you use and the error - it may help. – Rory Alsop♦ Apr 7 '11 at 12:04
up vote 1 down vote

Could you increase the metric for the default route then add a second default route at a lower metric?

share|improve this answer
I'll defiantly give that a try when i get back to dealing with this issue. – Ormis Apr 8 '11 at 13:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.