topic Re: ASA interface Subnet in Network Security

ASA interface Subnet

M.Sultan — Sat, 23 Sep 2023 23:08:34 GMT

Hello guys

I'm on ASA firewall, to assign IP for two interface- 1-int inside and the other is 2-int outside

for inside int 192.168.10.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0,it pops the below sys log message.

Failed to apply IP address to interface GigabitEthernet0/0, as the network overlaps with
the interface GigabitEthernet0/2. Two interfaces cannot be in the same subnet.

Does ASA make decision by looking to the subnet mask and doesn't care of IP network portion to differentiate ?

what is the solution for this ?

Thank you

Re: ASA interface Subnet

balaji.bandi — Sun, 24 Sep 2023 07:03:22 GMT

You can not use same IP address inside and outside ( that is not accepted)

Why do you need same IP address space inside and outside ?

Does ASA make decision by looking to the subnet mask and doesn't care of IP network portion to differentiate ? - yes it does.

you can subnet 192.168.10.0/24 in to /25 and use same subnet inside (first half )and outside.(second half).

Re: ASA interface Subnet

MHM Cisco World — Sun, 24 Sep 2023 07:09:08 GMT

The asa is work as router so role apply to router apply to asa.

Why you want same IP in inside and outside interface?

You can config asa as transparent and hence inside and outside can share same subnet (not same IP)

Re: ASA interface Subnet

M.Sultan — Mon, 25 Sep 2023 08:35:10 GMT

for inside int 192.168.20.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0,it pops the below sys log message.

Failed to apply IP address to interface GigabitEthernet0/0, as the network overlaps with
the interface GigabitEthernet0/2. Two interfaces cannot be in the same subnet.

there was an error sorry not the same subnet one is 192.168.20.20 255.255.255.0 and the other is 192.168.10.20 255.255.255.0 two different networks.

Re: ASA interface Subnet

M.Sultan — Mon, 25 Sep 2023 08:35:50 GMT

for inside int 192.168.20.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0,it pops the below sys log message.

Failed to apply IP address to interface GigabitEthernet0/0, as the network overlaps with
the interface GigabitEthernet0/2. Two interfaces cannot be in the same subnet.

there was an error sorry not the same subnet one is 192.168.20.20 255.255.255.0 and the other is 192.168.10.20 255.255.255.0 two different networks.

Re: ASA interface Subnet

Milos_Jovanovic — Mon, 25 Sep 2023 08:43:56 GMT

Hi @M.Sultan,

Could you please post the output of the "show run interface" command, for Gi0/0 and Gi0/2? If what you wrote is correct, I see no overlaps, thus no reason for ASA to give you that message. Could it be that mask is /23 on one interface?

Kind regards,

Milos

Re: ASA interface Subnet

MHM Cisco World — Mon, 25 Sep 2023 08:44:52 GMT

Share output of

Show interface ip breif

Re: ASA interface Subnet

M.Sultan — Mon, 25 Sep 2023 08:50:05 GMT

Resolving confusion :

Imagine an ASA firewall, inside = interface gig0/0 ip add 192.168.10.20 255.255.255.0

outside= interface gig0/1 ip add 192.168.20.20 255.255.255.0

it says overlap while it should'nt because i use two different network IPs not the same IP.

Re: ASA interface Subnet

M.Sultan — Mon, 25 Sep 2023 08:50:39 GMT

Resolving confusion :

Imagine an ASA firewall, inside = interface gig0/0 ip add 192.168.10.20 255.255.255.0

outside= interface gig0/1 ip add 192.168.20.20 255.255.255.0

it says overlap while it should'nt because i use two different network IPs not the same IP.

Re: ASA interface Subnet

Milos_Jovanovic — Mon, 25 Sep 2023 09:06:13 GMT

I do understand what you are trying to achieve. However, there is some configuration on your device that makes ASA to believe you are overlapping with existing configuration. Based on what you wrote here and your previous warning message, it looks to me that scope 192.168.10.0/24 is already used on Gi0/2, while you are trying to configure it on Gi0/0 now.

Kind regards,

Milos

Re: ASA interface Subnet

balaji.bandi — Mon, 25 Sep 2023 14:06:55 GMT

inside int 192.168.20.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0

if the 3rd octet changed that should work - until the config already applied and you try to use same IP it will not work

check interface config make sure when you configuration doing do not overlap same subnet.