ASA interface Subnet

[M.Sultan]

Hello guys

I'm on ASA firewall, to assign IP for two interface- 1-int inside and the other is 2-int outside 

for inside int 192.168.10.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0,it pops the below sys log message. 

Failed to apply IP address to interface GigabitEthernet0/0, as the network overlaps with
the interface GigabitEthernet0/2. Two interfaces cannot be in the same subnet.

Does ASA make decision by looking to the subnet mask and doesn't care of IP network portion to differentiate  ?

what is the solution for this ?

Thank you 

[balaji.bandi]

You can not use same IP address  inside and outside ( that is not accepted)

Why do you need same IP address space inside and outside ?

Does ASA make decision by looking to the subnet mask and doesn't care of IP network portion to differentiate  ?  - yes it does.

you can subnet 192.168.10.0/24 in to /25 and use same subnet inside (first half )and outside.(second half).

[M.Sultan]

for inside int 192.168.20.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0,it pops the below sys log message. 

Failed to apply IP address to interface GigabitEthernet0/0, as the network overlaps with
the interface GigabitEthernet0/2. Two interfaces cannot be in the same subnet.

there was an error sorry not the same subnet one is 192.168.20.20 255.255.255.0 and the other is 192.168.10.20 255.255.255.0 two different networks.

[MHM Cisco World]

The asa is work as router so role apply to router apply to asa.

Why you want same IP in inside and outside interface?

You can config asa as transparent and hence inside and outside can share same subnet (not same IP)

[M.Sultan]

for inside int 192.168.20.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0,it pops the below sys log message. 

Failed to apply IP address to interface GigabitEthernet0/0, as the network overlaps with
the interface GigabitEthernet0/2. Two interfaces cannot be in the same subnet.

there was an error sorry not the same subnet one is 192.168.20.20 255.255.255.0 and the other is 192.168.10.20 255.255.255.0 two different networks.

[Milos_Jovanovic]

Hi @M.Sultan,

Could you please post the output of the "show run interface" command, for Gi0/0 and Gi0/2? If what you wrote is correct, I see no overlaps, thus no reason for ASA to give you that message. Could it be that mask is /23 on one interface?

Kind regards,

Milos

[M.Sultan]

Resolving confusion :

Imagine an ASA firewall, inside = interface gig0/0 ip add 192.168.10.20 255.255.255.0 

outside= interface gig0/1 ip add 192.168.20.20 255.255.255.0

it says overlap while it should'nt because i use two different network IPs not the same IP.

[Milos_Jovanovic · Accepted solution]

I do understand what you are trying to achieve. However, there is some configuration on your device that makes ASA to believe you are overlapping with existing configuration. Based on what you wrote here and your previous warning message, it looks to me that scope 192.168.10.0/24 is already used on Gi0/2, while you are trying to configure it on Gi0/0 now.

Kind regards,

Milos

[M.Sultan]

Resolving confusion :

Imagine an ASA firewall, inside = interface gig0/0 ip add 192.168.10.20 255.255.255.0 

outside= interface gig0/1 ip add 192.168.20.20 255.255.255.0

it says overlap while it should'nt because i use two different network IPs not the same IP.

[MHM Cisco World]

Share output of 

Show interface ip breif 

[balaji.bandi]

 inside int 192.168.20.20 255.255.255.0 and outside int 192.168.10.20 255.255.255.0

if the 3rd octet changed that should work - until the config already applied and you try to use same IP it will not work

check interface config make sure when you configuration doing do not overlap same subnet.