Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm configuring a new ASA 5505 for deployment as a VPN endpoint in a remote office. After configuring it and connecting the VPN, I get the following messages:

WARNING: Pool ( overlap with existing pool.
ERROR: IP address,mask <,> doesn't pair is the address I configured for the ASA. It has the subnet mask

The ip address corresponds to one of our subnets, but it certainly wouldn't have a subnet mask of That looks more like a public IP address (and resolves to an ADSL connection somewhere). I am sure if we had such a subnet configured, that it would indeed overlap with

There is no reference to in the config of this ASA or our head office ASA.

Can anyone shed light on what is going on here? The sudden appearance of a strange subnet mask is a bit alarming.

share|improve this question
Post your config and we can help you out more. That message usually shows up when you specify a network address that isn't valid (like using a network address of and a subnet mask of The correct network address is – Jason Berg Feb 16 '11 at 15:22

Ok... you gave the device, with a /24 mask, /24 is another way of representing You have given 24 out of 32 available bits to the "network" leaving 8 for the hosts. That means the only hosts your device can directly talk to on that interface will have to have an address of or You've taken .200, and .0 and .255 are given up as overhead one being for the network the other for broadcast.

I believe what the message is saying, is that the network you tried to assign to a pool is not part of any network you've define elsewhere.

Is the "outside" interface of this ASA set to DHCP perhaps? Is it retrieving that IP from your ISP?

share|improve this answer
The outside interface is not configured by DHCP. It is static, and doesn't connect directly to the internet. I don't think that has anything to do with the errors I am seeing. – dunxd Feb 16 '11 at 15:08
I was just trying to ascertain where exactly the address is coming from. Can you post a sanitized configuration? I think you have a subnet mask wrong somewhere. And Jason is correct, the "network" above would have been – SpacemanSpiff Feb 16 '11 at 15:24

This post is a bit old but I had the same error and found the error in my allowed "http enable". I had named my network and when trying to insert the access-list with the same name + subnet mask it just didn't accept it. Just carefully look through the whole config and you will find the mismatch somewhere :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.