ASA routing in Security Cloud Control Firewall Management

Updated: July 17, 2026

Want to summarize with AI?

An overview of ASA routing, including interfaces, destination networks, gateways, metrics, and traffic path validation.

Routing protocols use metrics to evaluate what path will be the best for a packet to travel. A metric is a standard of measurement, such as path bandwidth that is used by routing algorithms to determine the optimal path to a destination. To aid the process of path determination, routing algorithms initialize and maintain routing tables, which include route information. Route information varies depending on the routing algorithm used.

Routing algorithms fill routing tables with various information. Destination or next hop associations tell a router that a particular destination can be reached optimally by sending the packet to a particular router representing the next hop on the way to the final destination. When a router receives an incoming packet, it checks the destination address and attempts to associate this address with a next hop.

Routing tables can also include other information, such as data about the desirability of a path. Routers compare metrics to determine optimal routes, and these metrics differ depending on the design of the routing algorithm used.

Routers communicate with one another and maintain their routing tables through the transmission of various messages. The routing update message is one such message that generally consists of all or a portion of a routing table. By analyzing routing updates from all other routers, a router can build a detailed picture of network topology. A link-state advertisement, another example of a message that is sent between routers, informs other routers of the state of the sender links. Link information can be used to build a complete picture of network topology to enable routers to determine optimal routes to network destinations.

About ASA Static Route

To route traffic to a non-connected host or network, you must define a route to the host or network, either using static or dynamic routing. Generally, you must configure at least one static route: a default route for all traffic that is not routed by other means to a default network gateway, typically the next hop router.

For general information on how ASA routing concepts and CLI commands, see the following documents:

Static and Default Routes chapter from ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, X,Y.
Static and Default Routes chapter from CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, X,Y.

Default Route

The simplest option is to configure a default static route to send all traffic to an upstream router, relying on the router to route the traffic for you. A default route identifies the gateway IP address to which the ASA sends all IP packets for which it does not have a learned or static route. A default static route is simply a static route with 0.0.0.0/0 (IPv4) or ::/0 (IPv6) as the destination IP address.

You should always define a default route.

Static Route

You might want to use static routes in the following cases:

Your networks use an unsupported router discovery protocol.
Your network is small and you can easily manage static routes.
You do not want the traffic or CPU overhead associated with routing protocols.
In some cases, a default route is not enough. The default gateway might not be able to reach the destination network, so you must also configure more specific static routes. For example, if the default gateway is outside, then the default route cannot direct traffic to any inside networks that are not directly connected to the ASA.
You are using a feature that does not support dynamic routing protocols.

Static Route Tracking

One of the problems with static routes is that there is no inherent mechanism for determining if the route is up or down. They remain in the routing table even if the next hop gateway becomes unavailable. Static routes are only removed from the routing table if the associated interface on the ASA goes down.

The static route tracking feature provides a method for tracking the availability of a static route and installing a backup route if the primary route should fail. For example, you can define a default route to an ISP gateway and a backup default route to a secondary ISP in case the primary ISP becomes unavailable.

The ASA implements static route tracking by associating a static route with a monitoring target host on the destination network that the ASA monitors using ICMP echo requests. If an echo reply is not received within a specified time period, the host is considered down, and the associated route is removed from the routing table. An untracked backup route with a higher metric is used in place of the removed route.

When selecting a monitoring target, you need to make sure that it can respond to ICMP echo requests. The target can be any network object that you choose, but you should consider using the following:

The ISP gateway (for dual ISP support) address.
The next hop gateway address (if you are concerned about the availability of the gateway).
A server on the target network, such as a syslog server, that the ASA needs to communicate with.
A persistent network object on the destination network.

Configure ASA Static Route

A static route defines where to send traffic for specific destination networks.

This section describes the steps to add a static route to an ASA device.

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the ASA tab.
	3.	Select a device you want to configure a static route.
	4.	In the Management pane on the right, click Routing.
	5.	Click to add a static route.
	6.	You can enter a Description for the route.
	7.	Select whether the route is for an IPv4 or IPv6 address.
	8.	Configure the route properties: Interface: Select the interface through which you want to send traffic. The gateway address needs to be accessible through this interface. You can use a Null0 route to forward unwanted or undesirable traffic so the traffic is dropped. Static Null0 routes have a favorable performance profile. You can also use static null0 routes to prevent routing loops. The ASA CLI accepts both Null0 or null0 strings. Gateway IP: (Not applicable to a Null0 route) Select the network object that identifies the IP address for the gateway to the destination network. Traffic is sent to this address. Metric: The administrative distance for the route, between 1 and 254. The default for static routes is 1. If there are additional routers between the interface and the gateway, enter the number of hops as the administrative distance. Administrative distance is a parameter used to compare routes. The lower the number, the higher precedence the route is given. Connected routes (networks directly connected to an interface on the device) always take precedence over static routes. Destination IP: Select the network object(s), that identifies the destination network, that contains the host(s), that uses the gateway in this route. Destination Mask (only for IPv4 addressing): Enter the subnet mask for the destination IP. Tracking (only for IPv4 addressing): Enter a unique identifier for the route tracking process.
	9.	Click Save.
	10.	Review and deploy the changes you made, or wait and deploy multiple changes at once.

Edit ASA Static Route

You can edit the static route parameters associated with an ASA device.

Note

However, you cannot select a different IP version while modifying the static route. Alternatively, you can create a new static route based on your requirement.

Procedure

	1.	Select an ASA device you want to edit the static route.
	2.	In the Management pane on the right, click Routing.
	3.	In the routing listing page, select a route you want to modify and in the Actions pane on the right, click Edit.
	4.	Modify the values you want and click Save. See Configure ASA Static Route for information on the routing parameters.
	5.	Review and Deploy the changes you made, or wait and deploy multiple changes at once.

Delete a Static Route

Before you begin

Deleting a static route may impact the connectivity to your device's local SDC or Security Cloud Control. Ensure a proper disaster recovery procedure is in place for any connectivity loss.

Procedure

	1.	Select an ASA device you want to delete.
	2.	In the Management pane on the right, click Routing.
	3.	In the routing listing page, select a route you want to modify and in the Actions pane on the right, click Delete.
	4.	Click OK to confirm the changes.
	5.	Review and Deploy the changes you made, or wait and deploy multiple changes at once.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.