ASA5520 DMZ sub-interfaces ip address error

[dchen0999]

Hi,

I get the following ip addressing error. Please help.

ERROR: Failed to apply IP Address to interface g0/2.2, as the network overlaps with int g0/2.1. Two interfaces can not be in the same subnet.

!
int g0/2
nameif DMZ
no security-level
no ip add
!

int g0/2.1
vlan 11

security-level 50

ip add 10.10.10.1 255.255.255.192  /26

!

int g0/2/.2
vlan 12

security-level 50

ip add 10.10.10.65 255.255.255.128  /25
!

int g0/2.3
vlan 13

security-level 50
ip add 10.10.10.193 255.255.255.192   /26

!

Thanks

[Loren Kolnes · Accepted solution]

Hi,

You are getting the error because the 2 networks do overlap.

10.10.10.0 /26

Host range - 10.10.10.1 - 10.10.10.62

10.10.10.65 /25 with this netmask the network that 10.10.10.65 belongs to is 10.10.10.0/25

Host range - 10.10.10.1 - 10.10.10.126

Hope this helps.

Regards,

Loren

[dchen0999]

Yes, I fully understand. Any fix, like ip classless, or no subnet-zero on ASA, advertize the route on eigrp. I check ip classless only works on cisco routers, not ASA.

Thanks Loren.

[dchen0999]

10.10.10.0/26
Host range - 10.10.10.1-63, 64-127, 128-191, 192-254

10.10.10.0/25
Host range - 10.10.10.1-127, 128-254

[Loren Kolnes · Accepted solution]

Hi,

The /25 mask puts interface Gig0/2.2 in the same subnet as Gig0/2.1.

There is no command that would allow this on the ASA.

The ip classless command on the router would not help here, the 2 networks overlap.

Here is what I did on a router in the lab:

router(config)#ip classless

router(config)#int loop 100

router(config-if)#ip add 10.10.10.1 255.255.255.192

router(config-if)#exit

router(config)#int loop 101

router(config-if)#ip add 10.10.10.65 255.255.255.128

% 10.10.10.0 overlaps with Loopback100

Is the /25 netmask supposed to be /26?

Thanks,

Loren

[dchen0999]

Thank you Loren.