Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a cisco ASA 5505 (ver 8.0.4) that currently has one IP address on the outside interface, 10.1.1.1. This is used for all communication with the outside world.

I want to add a second IP to this interface, 172.16.0.1, that will only get used for traffic to a specific remote IP (203.203.203.203)

That is, if a packet is for 203.203.203.203 it goes out the outside interface with a source IP of 172.16.0.1; any other traffic goes out the outside interface with a source IP of 10.1.1.1

The current config:

interface Vlan2
 nameif outside
 security-level 0
 ip address 10.1.1.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
global (outside) 1 interface
route outside 0.0.0.0 0.0.0.0 10.1.1.1 1

How can I add this second IP and make the required routing tweaks?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

You can't assign multiple IPs on the same interface to the unit itself.

What you can do is create a virtual interface on the same physical port with a different VLAN number, assign the 172 IP to that interface, route all your traffic to 203.203.203.203 through that, and then have something external to the ASA sit on the same VLAN and take care of routing that traffic further out.

share|improve this answer
add comment

I'm assuming you've obfuscated the ip addresses as 172.16.0.0/16 is a private range.

you would need to create a dynamic nat. First you would create an access list:

access-list custom_outside standard permit <inside_addresses> <inside_subnet>

then you would create a nat:

static (<from_int>,<to_int>) 172.16.0.1 access-list custom_outside

that would nat the addresses in the custom_outside acl to 172.16.0.1

share|improve this answer
    
I'm not trying to configure this additional IP for NAT, it's for the ASA itself for VPN purposes (as you deduced the 172.16.0.1 is really a routable IP) –  DrStalker Oct 14 '09 at 5:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.