ASA 8.6 allow publishing to only one range of Public IP

Lulzim Islami — Tue, 12 Mar 2019 01:32:11 GMT

Hi All,

Would someone comfirm that the versions 8.6 and up don't allow publishing to more then one public range if IP addresses?

We have ASA5520 version 8.4 in deployment and there I can NAT to 3 different ranges of public IP-s.

With same configuration on ASA5525-X version 8.6 it will NAT only the range that the outside interface belongs to.

Also tried the 9.0 version with the same result.

Thanks in advance

ASA 8.6 allow publishing to only one range of Public IP

Jouni Forss — Sat, 20 Apr 2013 17:11:00 GMT

Hi,

You will have to use some other software than 8.6(1)

Check the command "arp permit-nonconnected"

This will allow the ASA to populate its ARP table with nonconnected networks.

To be able to use this command you will need another software. Check this Cisco Release Notes section and especially the bottom section.

ARP cache additions for non-connected subnets

The ASA ARP cache only contains entries from directly-connected subnets by default. You can now enable the ARP cache to also include non-directly-connected subnets. We do not recommend enabling this feature unless you know the security risks. This feature could facilitate denial of service (DoS) attack against the ASA; a user on any interface could send out many ARP replies and overload the ASA ARP table with false entries.

You may want to use this feature if you use:

•Secondary subnets.

•Proxy ARP on adjacent routes for traffic forwarding.

We introduced the following command: arp permit-nonconnected.

This feature is not available in 8.5(1), 8.6(1), or 8.7(1).

Other option is to ask the ISP to route the nonconnected network towards the ASA directly.

Also you can check an explanation from a NAT 8.3+ document I created here on CSC

https://supportforums.cisco.com/docs/DOC-31116#MULTIPLE-SUBNETS

Hope this helps

Please remember to mark the question as answered if it did or ask more if needed

- Jouni

ASA 8.6 allow publishing to only one range of Public IP

Lulzim Islami — Sun, 21 Apr 2013 13:00:23 GMT

Hi Jouni,

Thank you for your clear explanation.

Valdet

topic ASA 8.6 allow publishing to only one range of Public IP in Network Security

ASA 8.6 allow publishing to only one range of Public IP

ASA 8.6 allow publishing to only one range of Public IP

ASA 8.6 allow publishing to only one range of Public IP