fina27
asked on
adding a secondary IP to same interface on a Cisco ASA 5510
My ISP gave me another block of IPs to use on the same interface. I know I can just add a secondary IP to the interface but what else do I have to do with the second gateway? Right now I just have a "route outside 0.0.0.0 0.0.0.0 y.y.y.y" command in the config. What else do I have to do to accomplish this 2nd block of IPs?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
>>I can't do a "ip address ip-address mask secondary" command on the interface?
No, it doesn't support the "secondary" option in the ASA code.
>>so if I just start doing "static (inside,outside) 'new WAN IP' LAN IP netmask mask" It will work?
As long as your ISP has done their part in routing that new net block to your edge router or device, then yes it will work.
No, it doesn't support the "secondary" option in the ASA code.
>>so if I just start doing "static (inside,outside) 'new WAN IP' LAN IP netmask mask" It will work?
As long as your ISP has done their part in routing that new net block to your edge router or device, then yes it will work.
ASKER
That didn't work. Should I create a sub-interface?
All you have to do is create static 1-1 nat xlates to the new ip range. Done.
ASKER
can you give me that command?
ASKER
static (inside,outside) y.y.y.y x.x.x.x netmask mask
y=wan
x=lan
I entered that command and tried to ping it and still cannot. Is there something else?
y=wan
x=lan
I entered that command and tried to ping it and still cannot. Is there something else?
you need to permit the traffic through the interface for the NAT to work.
something like:
access-list 101 permit tcp any host y.y.y.y eq 80
acess-group 101 in interface outside
which would allow traffic to a web server on IP y.y.y.y
something like:
access-list 101 permit tcp any host y.y.y.y eq 80
acess-group 101 in interface outside
which would allow traffic to a web server on IP y.y.y.y
You also cannot ping it from inside.
You also need to make sure that your ISP is routing that block of IP's to your PIX's current outside interface IP
You also need to make sure that your ISP is routing that block of IP's to your PIX's current outside interface IP
ASKER
So how can I configure this additional IP block? I just need a little more insight on how to implement it. I can't do a "ip address ip-address mask secondary" command on the interface?
"it's really just as simple as configuring static translations for the new block of IP addresses to point to internal IP addresses." ---- so if I just start doing "static (inside,outside) 'new WAN IP' LAN IP netmask mask" It will work?