Recently we upgraded our old FreeBSD firewall to a Cisco ASA5520 and I noticed that ASA does not generate ICMP Redirects if it is used as the "default router" or gateway for a network.
This is a problem in any network that has multiple subnets connected by multiple routers and the ASA is configured as the default router. The obvious solution is to add a default route to the firewall on your routers and set the "default gateway" on your hosts to the router but in my case the routers were really old with a horrible pps (packets per seconds) processing rate and didn't want to give them any more work than they already had.
