Solved

adding a secondary IP to same interface on a Cisco ASA 5510

Posted on 2007-12-03
9
7,105 Views
Last Modified: 2010-11-04
My ISP gave me another block of IPs to use on the same interface. I know I can just add a secondary IP to the interface but what else do I have to do with the second gateway? Right now I just have a "route outside 0.0.0.0 0.0.0.0 y.y.y.y"   command in the config. What else do I have to do to accomplish this 2nd block of IPs?
0
Comment
Question by:fina27
  • 4
  • 2
  • 2
  • +1
9 Comments
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
Comment Utility
>>"I know I can just add a secondary IP to the interface"

On an ASA, you cannot add a secondary IP address to an interface...are you talking about adding subinterfaces to be used in a VLAN environment, perhaps?

Truthfully, if your ISP has given you a new block of addresses that you want to be able to use, it's really just as simple as configuring static translations for the new block of IP addresses to point to internal IP addresses.  The ASA will perform proxy ARP for the new IP's.  You shouldn't even have to use the second gateway for the new block at all since you're routing would be taken care of by your existing default route.  As long as your ISP is taking care of routing the new block to your connection with them, then you should be OK and not have to specify the second gateway.
0
 

Author Comment

by:fina27
Comment Utility
Yeah as I was thinking about it more i figured that would be the case about the gateway.

So how can I configure this additional IP block? I just need a little more insight on how to implement it. I can't do a "ip address ip-address mask secondary" command on the interface?


"it's really just as simple as configuring static translations for the new block of IP addresses to point to internal IP addresses." ---- so if I just start doing "static (inside,outside) 'new WAN IP' LAN IP netmask mask"    It will work?
0
 
LVL 28

Expert Comment

by:batry_boy
Comment Utility
>>I can't do a "ip address ip-address mask secondary" command on the interface?

No, it doesn't support the "secondary" option in the ASA code.

>>so if I just start doing "static (inside,outside) 'new WAN IP' LAN IP netmask mask"    It will work?

As long as your ISP has done their part in routing that new net block to your edge router or device, then yes it will work.
0
 

Author Comment

by:fina27
Comment Utility
That didn't work. Should I create a sub-interface?
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
All you have to do is create static 1-1 nat xlates to the new ip range. Done.
0
 

Author Comment

by:fina27
Comment Utility
can you give me that command?
0
 

Author Comment

by:fina27
Comment Utility
static (inside,outside) y.y.y.y x.x.x.x netmask mask

y=wan
x=lan


I entered that command and tried to ping it and still cannot. Is there something else?
0
 
LVL 13

Expert Comment

by:td_miles
Comment Utility
you need to permit the traffic through the interface for the NAT to work.

something like:

access-list 101 permit tcp any host y.y.y.y eq 80
acess-group 101 in interface outside

which would allow traffic to a web server on IP y.y.y.y
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
You also cannot ping it from inside.
You also need to make sure that your ISP is routing that block of IP's to your PIX's current outside interface IP
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Suggested Solutions

From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
This tutorial demonstrates a quick way of adding group price to multiple Magento products.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now