Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a cisco ASA 5505 (ver 8.0.4) that currently has one IP address on the outside interface, This is used for all communication with the outside world.

I want to add a second IP to this interface,, that will only get used for traffic to a specific remote IP (

That is, if a packet is for it goes out the outside interface with a source IP of; any other traffic goes out the outside interface with a source IP of

The current config:

interface Vlan2
 nameif outside
 security-level 0
 ip address
interface Ethernet0/0
 switchport access vlan 2
global (outside) 1 interface
route outside 1

How can I add this second IP and make the required routing tweaks?

share|improve this question
up vote 1 down vote accepted

You can't assign multiple IPs on the same interface to the unit itself.

What you can do is create a virtual interface on the same physical port with a different VLAN number, assign the 172 IP to that interface, route all your traffic to through that, and then have something external to the ASA sit on the same VLAN and take care of routing that traffic further out.

share|improve this answer

I'm assuming you've obfuscated the ip addresses as is a private range.

you would need to create a dynamic nat. First you would create an access list:

access-list custom_outside standard permit <inside_addresses> <inside_subnet>

then you would create a nat:

static (<from_int>,<to_int>) access-list custom_outside

that would nat the addresses in the custom_outside acl to

share|improve this answer
I'm not trying to configure this additional IP for NAT, it's for the ASA itself for VPN purposes (as you deduced the is really a routable IP) – DrStalker Oct 14 '09 at 5:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.