topic First you have to ask in Network Security

ASA with IP aliases

Joseph S — Wed, 13 Mar 2019 01:09:11 GMT

Coming from a linux firewall environment, I find it very difficult to setup the ASA5585-X with the limitation of 1 IP per interface.

What are the options that we have to handle 5 ip aliases per interface on the ASA?

With linux you can do "ifconfig eth0:X" as many times as you need to add IP addresses to the same interface.

I know there is something that can be done with NAT but this seems complex and hard to trouble shoot in the future.

regards, Joseph.

On the ASA it´s NAT that you

Karsten Iwen — Mon, 14 Dec 2015 21:52:20 GMT

On the ASA it´s NAT that you have to use. There are no secondary ip addresses as on other systems (including IOS routers). But don´t worry, after a short time you´ll get used to this "native" method of handling multiple IPs on the ASA.

Do you have any examples?

Joseph S — Tue, 15 Dec 2015 00:24:47 GMT

Do you have any examples?

interface vlan2 10.10.30.1/24

interface vlan2 10.10.40.1/24

How would I do this?

What about the arp alias method? Is this a good method?

First you have to ask

Karsten Iwen — Tue, 15 Dec 2015 00:45:24 GMT

First you have to ask yourself what you want to do with the additional IP addresses. After that a way to implement it can be discussed.

We have lots of vlans.

Joseph S — Tue, 15 Dec 2015 01:08:45 GMT

We have lots of vlans.

And due to redundancy or other requests we have more than one subnet on a given vlan.

Changing vlans or ip addresses involve service outages.

To avoid outages, it seems to make sense to use aliases.

Ok, now I see what you want

Karsten Iwen — Tue, 15 Dec 2015 06:52:00 GMT

Ok, now I see what you want to achieve. Sadly, the ASA is the wrong device to support this kind of network-design.

That's a configuration that you should put on a layer 3 switch (or router). Both have more flexibility then the ASA here.

So, with the ASA is there

Joseph S — Tue, 15 Dec 2015 10:28:58 GMT

So, with the ASA is there really no way a person can handle more than one subnet per interface? Vlan interface that is?

This traffic does live on L3 routers. But from security concerns, and design it seems hard to think how to use the L3 routers in addition to the ASA.

You can build subinterfaces

Karsten Iwen — Tue, 15 Dec 2015 11:08:42 GMT

You can build subinterfaces that correspomnd to VLANs. But also here you have one IP network per subinterface/vlan. That's the (clean) network design that the ASA expects.