topic Re: Secondary IP on Outside Interface in Network Security

Secondary IP on Outside Interface

CCDECCDE9 — Mon, 11 Mar 2019 16:08:09 GMT

Is it possible to have seconday ip address on OUTSIDE Interface of ASA 5540 8.0(4) ? I am trying to get new ip scheme for our network and I have 1200 tunnels terminating to this box.I want to gradually move them to new IP address rather than replacing the IP of OUTSIDE Interface

Thanks

Re: Secondary IP on Outside Interface

Syed Iftekhar Ahmed — Thu, 20 Aug 2009 20:07:31 GMT

Both PIX and ASAs don't support secondary ip addresses.

Syed

Re: Secondary IP on Outside Interface

CCDECCDE9 — Wed, 02 Sep 2009 14:10:33 GMT

If I add an another interface to ASA and configure it with new ip ,can I terminate tunnels to this interface ?

Re: Secondary IP on Outside Interface

srue — Wed, 02 Sep 2009 15:21:07 GMT

is the new IP address in the same subnet as the existing outside interface?

Re: Secondary IP on Outside Interface

CCDECCDE9 — Wed, 02 Sep 2009 15:40:24 GMT

NO,It is anew subnet

Re: Secondary IP on Outside Interface

srue — Wed, 02 Sep 2009 16:00:35 GMT

then use an unused interface, or create a subinterface and apply the new IP.

Re: Secondary IP on Outside Interface

CCDECCDE9 — Wed, 02 Sep 2009 16:48:18 GMT

Today I have route for outside going through existing IP.When I add new interface and ip do I need to add any extra routing ?

Re: Secondary IP on Outside Interface

alig.norbert — Thu, 03 Sep 2009 15:07:45 GMT

On the ASA, there is only ONE default gw possible.

You have to add a static route for each site-to-site vpn (public IP and branch-LAN) to use the new WAN-interface.

Re: Secondary IP on Outside Interface

CCDECCDE9 — Thu, 03 Sep 2009 20:21:19 GMT

Is the following route correct ? ALso do I have to name it "Outside" and same security level as the existing "outside" interface

"route add outside 172.17.2.0 255.255.255.0 19.x.x.x "

where 172.17.2.0 = LAN on the other side of tunnel and

19.x.x.x =public ip of my new interface

Re: Secondary IP on Outside Interface

August Ritchie — Thu, 03 Sep 2009 20:35:29 GMT

If Outside is your new interface, here is your route statement.

route Outside 172.17.2.0 255.255.255.0

You don't want to route to your public interface, you want to route to the new interface's default route. Check out this example below for a full configuration idea.

2 interfaces: E1, E2

E1 is for all traffic but VPN

E2 is for VPN only

Default gateway for E1 is 77.0.0.1

Default gateway for E2 is 88.0.0.1

VPN peer is 65.0.0.1 255.255.255.255

VPN lan addresses 10.0.0.0 255.0.0.0

route E1 0.0.0.0 0.0.0.0 77.0.0.1

route E2 65.0.0.1 255.255.255.255 88.0.0.1

route E2 10.0.0.0 255.0.0.0 88.0.0.1