Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 4452
  • Last Modified:

Cisco ASA 5505, secondary IP on inside interface, same subnet

Greetings,

I have need to have my ASA5505 listen on 2 IP addresses in the same subnet on the INSIDE interface (VLAN1).

The reason - another device with this secondary IP is being removed and I need to have the ASA listen on *both* its own IP and the IP of the device removed, at least until I find every device using the old gateway IP.

Example:
ASA (inside, VLAN1): 192.168.1.1 255.255.255.0

Old device "X":  192.168.1.10 255.255.255.0

I need something similar to (in router-speak):
int vlan 1
  ip address 192.168.1.1 255.255.255.0
  ip address 192.168.1.10 255.255.255.0 secondary
0
snowdog_2112
Asked:
snowdog_2112
1 Solution
 
Jan SpringerCommented:
You need to put the other subnet in its own vlan and dot1q the interface.
0
 
snowdog_2112Author Commented:
They are in the SAME subnet as mentioned in OP.  Thanks for quick response though.

Both devices have IP's in 192.168.1.0/24.

The old device is gone and won't be replaced, so I need the ASA to "own" 2 IP's on the same subnet - if only for a short while (months, perhaps).
0
 
Gareth GudgerCommented:
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
snowdog_2112Author Commented:
Nope.

Again - the secondary IP is on the SAME SUBNET as the primary.  I can't route from one to the other, and even if I wanted to, I can't VLAN it, since both IP's are in the middle of the same /24.

I have a hunch that it is somehow related to NAT - the devices pointing to 192.168.1.10 (the old IP, which has an arp alias on the ASA) are not being NAT'd or unNAT'd properly.
0
 
Henk van AchterbergSr. Technical ConsultantCommented:
The ASA can only have on IP address on the inside interface.

Maybe you can use other solutions like a layer 3 switch or second (cheap) router.
0
 
snowdog_2112Author Commented:
Love Cisco...

HATE Cisco!

The ASA is "not a router", so for small businesses who might possibly need some routing features, you need an ASA for $500 and another "real router" for another $500-1000.

Or...a $200 Netgear.

At least on an ASA you can type exec commands in conf mode without "do <command>", unlike Cisco routers.

Fair trade-off....maybe.
0

Featured Post

[Webinar] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now