I am working on translating configuration from a firewall named Joebox to ASA 5515.
On Joebox, it has 5 continuous public IP addresses (xx.xx.xx.73 -77/29), first one as interface IP and others as alias, on the Internet-facing interface.
I need to configure ASA 5515 in the same way, however it seems not simple.
- The way to configure subinterfaces on 5515 is by configuring VLAN.
- The interface can hold xx.xx.xx.73/29 without a problem.
- The first subinterface can have IP address xx.xx.xx.74 however with different mask(/16), as it doesn’t allow /29.
- The second subinterface doesn’t allow to enter IP xx.xx.xx.75, saying "Failed to apply IP address to interface GigabitEthernet0.x, as the network overlaps with interface GigabitEthernet0. Two interfaces cannot be in the same subnet."
I believe that there should be a workaround for this.
Can someone please help?
Thank you in advance.
You can configure Ip addresses on interfaces, only if they are from different subnet. ASA will not allow you to put this commands.
From subnet 192.168.0.73/29HostMin: 192.168.0.73
So, can you please describe what is the purpose of this configuration? What you want to achieve?
Please rate helpful posts
As you are using ASA5515 you are probably running software version 8.6 (confirmable with command "show version")
If I understood you correctly you have a /29 network from the ISP and want to use 1 IP for the "outside" interface and the rest of them as Static NAT IP address for different LAN hosts?
Assuming that the following apply
Your configurations could look something like this
Default PAT for traffic heading to Internet
object-group network PAT-SOURCE
description PAT Source Networks
network-object 10.10.10.0 255.255.255.0
nat (any,outside) after-auto source dynamic PAT-SOURCE interface
Static NAT for servers
object network STATIC-1
nat (inside,outside) static x.x.x.74
object network STATIC-2
nat (inside,outside) static x.x.x.75
object network STATIC-3
nat (inside,outside) static x.x.x.76
object network STATIC-4
nat (inside,outside) static x.x.x.77
Access-list rules from Internet
access-list OUTSIDE-IN permit ip any object STATIC-1
access-list OUTSIDE-IN permit tcp any object STATIC-1 eq
access-list OUTSIDE-IN permit udp any object STATIC-1 eq
access-list OUTSIDE-IN permit ip any host 10.10.10.10
access-list OUTSIDE-IN permit tcp any host 10.10.10.10 eq
access-list OUTSIDE-IN permit udp any host 10.10.10.10 eq
access-group OUTSIDE-IN in interface outside
Hope the above was of some help. Please rate helpfull posts
And just to clarify a bit,
You dont configure the addiotional public IP addresses to any interface. You only give the interface its IP address. Rest of the IP addresses only need the NAT commands, nothing else.
Thanks a lot for your reply.
My goal here is simple.
I need to configure 5515 exactly the same way as Joebox (less known firewall), for my customer.
Somehow, Joebox has 5 continuous public IP addresses on the physical interface, and I need to configure 5515 the same way.
Those IPs are routed to inside resources through NATing.
Let me know if further information is needed.
Would there be any workaround for this?
Any suggestions would be much appreciated.
Thank you for clarification,
Your ISP will route traffic to your ASA. You do not need to assign the new IP to any interface. You can create statics using the address space and it will work because of the ISP sending the route down to you. Also you need to allow this connections using access-lists
Please rate helpfull posts