topic You can't have both in Network Security

Multiple External Subnets

Tarran — Tue, 12 Mar 2019 04:55:40 GMT

Hi All,

We have a Cisco ASA 5505; we have just upgraded our internet service with Comcast and with the information they have sent me, I'm not sure how i would configure our ASA with the two different subnets on the outside interface.

This is what they have sent:

IP Allocations:
Interconnect block – 50.100.77.96/30
Netmask: 255.255.255.252
Comcast Internet gateway: .97
Customer’s WAN interface: .98

Primary DNS: 75.75.75.75 Secondary DNS: 75.75.76.76

Customer’s useable IP block – 50.100.77.112/28
Netmask: 255.255.255.240
Usable IPs: 50.100.77.113 thru .126
The /28 of usable IP space is statically routed by Comcast to 50.100.77.98

Could someone please suggest how i would best go about this?

Many thanks,
Tarran

You can't have both

Marvin Rhoads — Tue, 14 Oct 2014 19:16:03 GMT

You can't have both simultaneously handling your traffic. The closest you can do directly on the ASA is to have one path as a backup route which only takes over when the first is not seen. Reference. (old guide but still valid)

Otherwise you need to use an upstream router.

I read your post completely

Karsten Iwen — Tue, 14 Oct 2014 19:48:08 GMT

I read your post completely different then Marvin ... It seems that you just got a second subnet so that you have more usable addresses? And your outside IP is 50.100.77.98? Then you can either use that new subnet as a DMZ-interface on the ASA, or you can use the addresses of this new range as public NAT-objects for incoming and outgoing traffic.