ASA 5520 use secondary public IP as termination point

[ij@techotel.no]

Hi

Got an ASA 5520 and a block og public ip addresses. I uses a.b.c.d as the public IP and that is used for the WAN interface. I would then like to use a.b.c.e as the ip that the IPSec Site-2-Site VPN connects to from the remote networks. Not sure how to do it or if it is possible. Some how I need to forward the public IP a.b.c.e to the VPN service.

[Sheraz.Salim]

so your ASA outside interface has an ip address a.b.c.d configured. but you want yours site to site vpn to use another public ip address.

i thing that not possible as  your other address is not in service. and is not binded to any outside interface.

[ij@techotel.no]

Is it then possible to bind two (or more) public IP's to the same (WAN)interface?

[Sheraz.Salim · Accepted solution]

no. what exactly you after?

you want your site-to-site vpn to connect to a different public ip address. any reason why is that?

[ij@techotel.no]

The guys in charge had an idea of less activity if it wasn't the IP found by trace back from accessing the internet from inside the network. But thanks for letting me know that it is not possibly. 

[Rob Ingram]

You can achieve what the guys in charge want by natting the outbound internet traffic using a different IP address. It's probably natted behind the outside interface IP address currently, it would just need modifying to another IP address in your public address range.

HTH

[Sheraz.Salim]

@Rob IngramI see what you saying. even in that case though the remote side need to connect to public ip address of the ASA outside interface. Than nat can put in place for the another public ip address. at the end of the day remote peer need a ip address that is configured on the outside interface.

[Rob Ingram]

The VPN would still terminate on the outside interface IP address. The nat suggestion is for outbound internet traffic only, nothing to do with VPN, but they achieve the result of the "guys in charge".

[Sheraz.Salim]

do you have any example config. interested to see them.

[ij@techotel.no]

We skipped the idea and just configured as "normal".