Configuring Static Route Tracking - Cisco PIX 500 Series Configuration Manual

Configuring Static and Default Routes

Configuring Static Route Tracking

One of the problems with static routes is that there is no inherent mechanism for determining if the route
is up or down. They remain in the routing table even if the next hop gateway becomes unavailable. Static
routes are only removed from the routing table if the associated interface on the security appliance goes
down.
The static route tracking feature provides a method for tracking the availability of a static route and
installing a backup route if the primary route should fail. This allows you to, for example, define a
default route to an ISP gateway and a backup default route to a secondary ISP in case the primary ISP
becomes unavailable.
The security appliance does this by associating a static route with a monitoring target that you define. It
monitors the target using ICMP echo requests. If an echo reply is not received within a specified time
period, the object is considered down and the associated route is removed from the routing table. A
previously configured backup route is used in place of the removed route.
When selecting a monitoring target, you need to make sure it can respond to ICMP echo requests. The
target can be any network object that you choose, but you should consider using:
•
•
•
•
You can configure static route tracking for statically defined routes or default routes obtained through
DHCP or PPPoE. You can only enable PPPoE clients on multiple interface with route tracking.
To configure static route tracking, perform the following steps:
Step 1 Configure the tracked object monitoring parameters:
a.
b.
c.
Cisco Security Appliance Command Line Configuration Guide
9-4
the ISP gateway (for dual ISP support) address
the next hop gateway address (if you are concerned about the availability of the gateway)
a server on the target network, such as a AAA server, that the security appliance needs to
communicate with
a persistent network object on the destination network (a desktop or notebook computer that may be
shut down at night is not a good choice)
Define the monitoring process:
hostname(config)# sla monitor sla_id
If you are configuring a new monitoring process, you are taken to SLA monitor configuration mode.
If you are changing the monitoring parameters for an unscheduled monitoring process that already
has a type defined, you are taken directly to the SLA protocol configuration mode.
Specify the monitoring protocol. If you are changing the monitoring parameters for an unscheduled
monitoring process that already has a type defined, you are taken directly to SLA protocol
configuration mode and cannot change this setting.
hostname(config-sla-monitor)# type echo protocol ipIcmpEcho target_ip interface
if_name
The target_ip is the IP address of the network object whose availability the tracking process
monitors. While this object is available, the tracking process route is installed in the routing table.
When this object becomes unavailable, the tracking process removed the route and the backup route
is used in its place.
Schedule the monitoring process:
hostname(config)# sla monitor schedule sla_id [life {forever | seconds }] [start-time
{ hh : mm [: ss ] [ month day | day month ] | pending | now | after hh : mm : ss }] [ageout
seconds ] [recurring]
Chapter 9 Configuring IP Routing
OL-12172-03