ASA 8.4 to 9.2 with discontiguous outside IP address blocks

[Steve Bellan]

Have a customer that is running 8.4 with discontiguous IP address space on the outside. They are wanting to go to 9.2. The SE they are working with told them that discontiguous IP blocks on the outside are no longer supported in 9.2. It looks like this is corrected with the "arp permit-nonconnected" command. Anyone else hear of this?

[Collin Clark]

Hi Steve-

The SE is correct and 'arp permit-nonconnected' resolves the issue of having public IP's that are not directly connected.

HTH.

[Karsten Iwen]

Here is the link to the command-reference:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/a3.html#pgfId-1837762

If the additional address space is only used on the ASA, then consider to let the provider route the additional subnets to the ASA instead of using them as additional secondary networks. That way you can keep the (new) default behavior of the ASA.