Hi,
I have run into situation where this would have been usefull but I have always gone with a different setup and not configured any secondary networks under one interface.
If you are indeed configuring another subnet under the same LAN interface I guess you can do it a few commands. I'm not sure if theres been some changes to the ASA software that might cause problems.
To my understanding the configuration used to be like this
- Existing subnet: 192.168.1.0/24
- ASA Interface IP: 192.168.1.1
- New subnet: 192.168.2.0/24
- ASA Interface IP: 192.168.2.1
Commands
- arp inside 192.168.2.1 1234.5678.90ab alias
- route inside 192.168.2.0 255.255.255.0 192.168.1.1
- same-security-traffic permit intra-interface
I would expect this has limitations but I can't say for sure as I have never resorted to it myself. It might not even work anymore depending on your software. I would suggest looking at the whole network setup, perhaps handling this with a real router instead of ASA. Perhaps configuring a Trunk between ASA and some LAN Switch and creating a separate ASA interface for both subnets.
But this is just my personal suggestion. I always try to keep things simple and avoid special setups. In the long run you might either be causing a bigger headache for yourself or just end up doing the change which would have been best in the first place
- Jouni
