1

I'm configuring a new ASA 5505 for deployment as a VPN endpoint in a remote office. After configuring it and connecting the VPN, I get the following messages:

WARNING: Pool (10.6.89.200) overlap with existing pool.
ERROR: IP address,mask <10.10.0.0,93.137.70.9> doesn't pair

10.6.89.200 is the address I configured for the ASA. It has the subnet mask 255.255.255.0.

The ip address 10.10.0.0 corresponds to one of our subnets, but it certainly wouldn't have a subnet mask of 93.137.70.9. That looks more like a public IP address (and resolves to an ADSL connection somewhere). I am sure if we had such a subnet configured, that it would indeed overlap with 10.6.89.200.

There is no reference to 93.137.70.9 in the config of this ASA or our head office ASA.

Can anyone shed light on what is going on here? The sudden appearance of a strange subnet mask is a bit alarming.

1
  • 1
    Post your config and we can help you out more. That message usually shows up when you specify a network address that isn't valid (like using a network address of 10.10.0.1 and a subnet mask of 255.255.255.0. The correct network address is 10.10.0.0).
    – Jason Berg
    Feb 16, 2011 at 15:22

2 Answers 2

1

Ok... you gave the device 10.6.89.200, with a /24 mask, /24 is another way of representing 255.255.255.0. You have given 24 out of 32 available bits to the "network" leaving 8 for the hosts. That means the only hosts your device can directly talk to on that interface will have to have an address of 10.6.89.1-199 or 10.6.89.201-254. You've taken .200, and .0 and .255 are given up as overhead one being for the network the other for broadcast.

I believe what the message is saying, is that the network you tried to assign to a pool is not part of any network you've define elsewhere.

Is the "outside" interface of this ASA set to DHCP perhaps? Is it retrieving that IP from your ISP?

2
  • The outside interface is not configured by DHCP. It is static, and doesn't connect directly to the internet. I don't think that has anything to do with the errors I am seeing.
    – dunxd
    Feb 16, 2011 at 15:08
  • I was just trying to ascertain where exactly the address is coming from. Can you post a sanitized configuration? I think you have a subnet mask wrong somewhere. And Jason is correct, the "network" above would have been 10.6.89.0/24 Feb 16, 2011 at 15:24
1

This post is a bit old but I had the same error and found the error in my allowed "http enable". I had named my network and when trying to insert the access-list with the same name + subnet mask it just didn't accept it. Just carefully look through the whole config and you will find the mismatch somewhere :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .