static routes not applying

What if you make that a Policy route, Mast?

Cheers - Bob

Hi,

the route is defined on eth0. Is this the correct interface were the clients are connected to?

What about the configured interface in the host object 8.8.8.8? Is it correct?

Could you post the whole routing table of the UTM?

Jas Man

Policy route makes no difference

eth0 is the lan port, yes client are connected in that LAN, same as the cisco ASA.

"What about the configured interface in the host object 8.8.8.8? Is it correct?", ¿what configured interface?, they're internet hosts (or remote private ip hosts through one of the VPNs in the Cisco ASA)

You've been around for a long time, Mast, and I know you know the UTM well, so it must be something you're not seeing.  Please show pictures of the Edits of the relevant parts of the configuration.

Cheers - Bob

Shot in the dark here just to be sure. Did you try it with another host ip? Because 8.8.8.8 is google's dns server and maybe the UTM is getting mixed up there ie you have 8.8.8.8 entered somewhere else?

Bob,

the thing is that this was working as-is and one of the previous patches broke it.

it's also quite simple really:

in the LAN i have the UTM and an ASA on the same subnet.

there is a list of networks and hosts that have to be routed through the ASA, all of which defined in a group in the UTM

then i made the static gateway route rule that for those hosts the gateway is the ASA.

then i created a FW rule from LAN to hosts allowing the services i need.

i check the route list and the entry is there

and it's not working, it's ignoring the route and going through internet.

yet if i do the same on a mikrotik, works perfectly, same as adding a route by hand on windows.

I already have a case open but communicating has been... very difficult at best, they suggested something about the web proxy interfering if i understood them... i'll have to check that.

edit: just checked, i alreayd have a transparent skiplist destinarion set...

Mast_01 said:

...

"What about the configured interface in the host object 8.8.8.8? Is it correct?", ¿what configured interface?, they're internet hosts (or remote private ip hosts through one of the VPNs in the Cisco ASA)

Your wrote, that you've configured a static route for the target "8.8.8.8" that points to the ASA. This static route has an host or network object in the field "Network". And this object has an field, where you can define the interface where the host or network is homed (Any, LAN, WAN,...).

Please also post or check the routing table. There must be a reason why the UTM preferred the Any-route to the Internet. 

BTW: Have you checked that the routing rule is activated? Maybe it's such a simple thing...

EDIT: Gateway Routing works fine for me in 9.411-3. Entry in routing table:

8.8.8.8 via 192.168.10.3 dev eth1.10  proto static  metric 1 onlink 

Jas Man

JAS,

i have a group that contains both hosts AND networks(i hope the uploadrs are visible)

yes the rule is active :D

the route table is huge and full of ips, but i checked and they're there(it's a portion of the table), both public and private tunnels:

default via 10.10.10.200 dev eth0  table 1  proto policy 

200.x.x.x. via 10.10.10.200 dev eth0  proto static  metric 1 
200.x.x.x via 10.10.10.200 dev eth0  proto static  metric 1 
200.x.x.x via 10.10.10.200 dev eth0  proto static  metric 1
172.16.6.170 via 10.10.10.200 dev eth0  proto static  metric 1 
172.16.6.171 via 10.10.10.200 dev eth0  proto static  metric 1 
192.168.2.5 via 10.10.10.200 dev eth0  proto static  metric 1 
192.168.2.13 via 10.10.10.200 dev eth0  proto static  metric 1  

Looks good.

So default and static route pointing to the ASA?

And which address is routet by the UTM directly trought the Internet, WAN or what else is behind the UTM?

Have you tried to re-create the rule, or to choose only a single host, not the complete group?