Showing results for 
Search instead for 
Did you mean: 

Two subnets from ISP one gateway

Level 1
Level 1

I just received a set of public IPs from my ISP. I configured everything internally and can see the IPs internally etc. However I can not get out to the internet using those IPs. I reached out to my ISP about it since I saw a lot of times this is handled on the ISP side of the house but they said I would need to configure it on my side. Basically I'm trying to use the old gateway with the new subnet. I know it's possible just not sure how.

I have an ASR-1001-x with the ISP on port Gi0/0/0, the original subnet is on Gi0/0/1 and the new subnet on Gi0/0/4. The person I spoke with at the ISP said to look into setting up two gateways on the ASR. Any help would be appreciated.



1 Accepted Solution

Accepted Solutions

I would say that public subnet needs to be on the wan interface as a secondary and then you can an internal private subnet on gig0/4 interface which will allow you to nat on that private subnet

int gig0/0
ip nat outside
ip addres 54.16.x.x secondary
int gig0/4
ip nat inside
Ip address

access-list 10 permit
ip nat pool NATPOOL1 54.16.x.x  54.16.x.y prefix-length 29
ip nat inside source-list 10  pool NATPOOL

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards

View solution in original post

25 Replies 25


Hello @mattmayer 

what do you mean by "I configured everything internally and can see the IPs internally" ?

Do you perform NAT on taht ASR 1001-x ? What about routing table ? ou have default-route towards ISP ?

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

No NAT on the ASR. Routing table shows the old route with the default route going to the ISP. It also shows the new IPs directly connected. However if I'm on that new subnet I can reach my old subnet and vice versa but unable to get out to the internet.


A traceroute from that 1001-X with IP source one of the new IP public, next-hop is your ISP ?

Best regards
.ı|ı.ı|ı. If This Helps, Please Rate .ı|ı.ı|ı.

This is the weird part... when I go from the new subnet to say it dies from the start, but when I send a trace route to an IP on the old subnet it hops to the ASR and continues on just fine.

Old GW with new subnet 

This not work'

The ISP will use new subnet with new GW' they add it to routing table point to your new GW.


Richard Burts
Hall of Fame
Hall of Fame


If we knew more about your environment we might be able to give better advice. As a start can you tell us more about the public IPs that you received? You mention using old gateway with new subnet. Can you provide details about these? 

Is something in your network doing Network Address Translation? In some networks that might be done on the edge router, or done on the firewall, or done somewhere else. What can you tell us about nat in your environment?

What is the addressing on G0/0/0 connecting to the ISP?? What is the subnet on G0/0/1? and what is on G0/0/4?



Hi Richard,

I'll attach a pic to hopefully clear things up a little bit more. IPs have been changed to protect the innocent. As for NAT translation that is done by an ASA firewall that sits off the first subnet.



Thanks for the diagram, which is helpful. Am I correct in understanding that the mask for the G0/0/0 is /30. If not what is it?

Also am I correct in understanding that originally the ISP gave you 2 Public address blocks (a /30 as a transit subnet and a /29 for use by devices in your internal network)? And correct in understanding that the same ISP has now given you a second /29 of Public IPs? If not what is correct?

Also, do you have devices connected in subnet B using the new IP addresses? If so does their default gateway point to the address of G0/0/4?

Also are there any security policies, acls, etc on G0/0/0 checking traffic coming in from the Internet?




Correct, the mask for Gi0/0/0 is a /30 and correct the /30 for transit and the /29 for my devices. And also correct I have a new /29 from the ISP.

I do have a device on the new subnet and the default gateway is the IP from gi0/0/4. I can route internally from that subnet to the old subnet but not out to the internet.

No security policies in place


Thanks for confirming my understanding of the environment. To investigate this please do these steps and let us know the result on the ASR (either console, or telnet/SSH):
- attempt to ping specifying the source as the address on G0/0/1
- attempt to ping specifying the source as the address on G0/0/4
Also would you post the config of G0/0/0?




Here you go:

ASR-01#ping source x.x.13.17
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Packet sent with a source address of x.x.13.17
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/3/4 ms

ASR-01#ping source x.x.79.50
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Packet sent with a source address of x.x.79.50
Success rate is 0 percent (0/5)

interface GigabitEthernet0/0/0
description ISP1
bandwidth 100000
ip address
load-interval 30
negotiation auto




Thanks for trying what I suggested. As I suspected might be the case it shows that your ISP is not routing for the new block of addresses. Just checking assumptions: the new block of Public IP is from the same ISP as your first block?

Assuming that both address blocks are from the same ISP I suggest that you ask the ISP for help in finding why the new block is not working.




That not correct, it not issue of ISP.

This case not clear until now 

I check your supernet it different 

So you can use as @paul driver mentioned secondary IP under interface connect to ISP after you remove IP from other interface

Which lead us to second point 

*****Rourer can not accept same subnet in two interfaces so old subner As I see in two interfaces and the only explain is you use BDI, are you use BDI? *****



Are you saying that when ping specifying one source is successful and ping to same destination specifying a different source is not an issue of ISP? What do you think the issue is? 

Yes the supernet is different. The new address block can be used only in one place. It could be used as secondary address on an interface that has some other subnet as primary, or it could be primary on its own subnet. But the issue in the earlier post appears to be that he was trying to do both.


Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card