Showing results for 
Search instead for 
Did you mean: 

Multiple IP's on an ASA

Level 1
Level 1

I have a couple of questions about configuring an ASA with multiple public IP's and sending traffic in and out of the same interface.  We have two ARIN public IP blocks assigned to us.  They are both advertised through BGP on our frontend routers.  Our ASA's, in our current configuration we have a set of Main ASA's and DMZ ASA's, have a public IP assigned to their outside interfaces from one of the ARIN IP blocks.  The other IP block is routed to the ASA's IP by our routers.  So, for example, and are the two ARIN IP blocks.  The outside interfaces of both sets of ASA's are assigned an IP from the block.  The block is routed to the 10.1.1.x IP of the ASA's.  Also, with this configuration, our internal hosts behind the Main ASA's can connect to the internal hosts behind the DMZ ASA's using the public IP's and vice versa.  Attached is a diagram of our current configuration.

This summer, we will be changing this configuration and that is where I have my questions.  We are eliminating the set of DMZ ASA's and only want to use the set of Main ASA's.  So, one issue that arises is that Host 1 will no longer be able to connect to Host 2 because they will be behind the same ASA.  As I understand it, by design, traffic is not allowed to leave and come back in the same ASA interface.  So, I am trying to determine the best way to make this new configuration work.  My first thought is to configure a second outside interface on the ASA and assign a 10.1.1.x IP to one outside interface and a 11.1.1.x IP to the second outside interface.  This will allow Host 1, who has a 10.1.1.x IP, to connect to Host 2, who has a 11.1.1.x IP and vice versa.  But are there any different ways to accomplish this configuration without using a second interface with a separate IP?  Can EtherChannel or trunk ports be used and still handle the two IP blocks and the host connectivity out and back in?  Can subinterfaces be used and still handle the two IP blocks and the host connectivity out and back in?  Other options?

1 Reply 1

Philip D'Ath
VIP Alumni
VIP Alumni

Why not get rid of NAT, and put the public IP addresses directly on the hosts?

That would make everything considerably more simple.

Review Cisco Networking for a $25 gift card