topic Philip, in Network Security

Different interfaces with IP in the same subnet

marcio.tormente — Tue, 12 Mar 2019 07:54:08 GMT

Hello Folks!

I have to migrate the configuration of Linux firewall to ASA 5516, but I have a problem:

My customer have 3 different links with the same ISP with the same subnet, example:

Link 4MB IP 201.1.1.1/24

Link 15MB IP 201.1.1.3/24

Link 10MB IP 201.1.1.10/24

When I try to configure it on ASA, I have the problema with overlap.

Anyone knows how to solve this problem?

Thanks

Marcio

And it should not work. The

Philip D'Ath — Thu, 16 Jun 2016 22:25:09 GMT

And it should not work. The is not a valid IP addressing scheme. You need to fix the fundamental IP address issue first.

You could potentially plug all three circuits into a switch, and then into the outside interface of the ASA. Configure it with one of those IP addresses, and then NAT the other two to where ever you want them to go to.

Philip,

marcio.tormente — Fri, 17 Jun 2016 14:46:25 GMT

Philip,

thanks for your support

In the Linux firewall there are a lot of NAT to each link, if I install all links in the switch, I have to do NAT twice, right?

Or do you think is better do the NAT on the L3 switch and in the ASA only controll the access?

Thanks

No, there would be no need

Philip D'Ath — Sat, 18 Jun 2016 04:46:04 GMT

No, there would be no need for double NAT.

L3 switches typically do not do NAT.

I know some switches have

marcio.tormente — Fri, 24 Jun 2016 14:17:18 GMT

I know some switches have some limitations, but in this case, the switch is not Cisco, then, my customer will be responsable to all configuration.

He give me the sugestion to use proxy-arp and NAT to solve this problem.

To be honest, I don´t know nothing about proxy-arp.

You might look into the 9.6

James Leinweber — Mon, 27 Jun 2016 16:54:30 GMT

You might look into the 9.6 series "zone" support, which is the first time we've seen ASA cope with multiple uplinks gracefully. It's been a historical pain point.

Thanks James,

marcio.tormente — Mon, 27 Jun 2016 17:07:24 GMT

Thanks James,

I´ve been talk to others experts in ASA, and none of then knows another way to do it, only with NAT 1:1 or dynamic PAT.