FirePower 1000 series add several pools to the outside interface

[RicardoMG]

Hi Community!

I have a Firepower 1000 series.

We have two public IP pools asigned by our ISP (2x /29). There is only one cable connected directly between the ISP router and our FirePower outside interface. Using one IP from one of the pools (first pool), we have asigned the outside interface IP. The final idea will be use all the public ip (the rest of the first pool and the second one) and create NAT to our local servers.

Nowadays, we have running a ASA 5520 consuming these pools with same configutation that I mentioned before and we can consume all the IPs and it is working now but, the idea, is change it for the new FirePower 1000 Series.

The option that we use in the ASA 5520 to configure the outside pools is the "Global IP" but unfortunately, in the new FirePower, there is no this option.

In addition, testing with the FirePower, using the NAT option, we could configure NAT with the second pool but when we try to make the same with the first pool (in which one of them is used to configure the IP in the outside interface), we can not consume them.

Can you give us information about the way to configure serveral pools in the outside interface? Is possible that we need an additional license the have this functionality?

Thank you so much for your assistance.

[MHM Cisco World]

A-I think even with ASA the NATing to POOL, the subnet POOL must match the OUT interface 
if you have one cable from SP and two separate public subnet, then I think you can connect SW between FW and SP and 
use to interface in FW to connect to SW.
the most important is SP know both subet.

B- I check the cisco ASA guide there is not restriction for point A, still please monitor NATing 
but in guide there is solution for your case 
config object group include to object network for each POOL and then use object group in NATing instead of both POOL object network 

[Rob Ingram · Accepted solution]

@RicardoMG you just need to get the ISP to route the second /29 network to the IP address of your Firewall. You can then define NAT objects using the second network.

You don't need additional licenses.

[RicardoMG]

Thank you so much for your help. In the laboratory that we have created for the issue, it was enough creating the NAT for each IP from the each pool to the local server. For the next step, we are going to ensure with the ISP, that all the traffic is redirected to the IP that we have configured in the outside interface.

Thank you so much to all!