Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're currently PATing everything from a particular subnet to the IP of an outside interface using our ASA5585 (dynamic PAT). We're experiencing pool exhaustion and therefore need to expand the global IP range. Can anyone think of a way of cutting over to the new range without dropping existing connections? Thanks for looking!

share|improve this question
Is the new range completely different, or merely an expanded (overlapping) range? – bahamat Oct 26 '12 at 1:16
It's a completely new range within the same overall subnet. i.e. the current interface address is x.x.x.37/22 and the new PAT pool is x.x.x.114-6/22 – James Oct 26 '12 at 3:59

Based on your comment above it's impossible.

If you're completely changing the IP address of the external pool then whatever connections you have must be reestablished. The remote endpoint would need to somehow know to re-use the same session with a new IP address.

The only way it would be possible is if the entire old range is contained entirely within the new range. Even then I don't know what the ASA would do (but if it's designed right the existing sessions would continue). But I do know that if you're entirely changing your pool, all sessions must drop.

share|improve this answer
Thanks for trying, but your answer isn't correct. – James Oct 31 '12 at 7:30
up vote 0 down vote accepted

As per the thread at I can confirm that when you change the NAT rule, existing translations are maintained and new connections use the new pool.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.