2

I currently have a single network 192.168.1.0/24 and I am running out of IP addresses. I have a ASA 5505 connecting us to the outside world. I would like to be able to add a subnet say 192.168.20.0/24 on the same switches throughout the plant by just having a windows or linux based router with and IP on both networks. I have tried doing this with very limited success. I have a windows machine with two ips. One on 192.168.1.0/24 and one on 192.168.20.0/24 put a route to 192.168.20.0/24 on that machine. Then use that machine's 192.168.20.0/24 ip as the default gateway for the other 192.168.20.0/24 machines. I then have added a route on the asa for 192.168.20.0/24 network back to the windows machine for the inside interface.

I can ping both sides of the windows machine from the 192.168.20.0/24 clients but no other machines on the 192.168.1.0/24 network. I can ping both networks from the asa. I have network access from the 192.168.1.0/24 network but not from the 192.168.20.0/24 network. I cannot ping the 192.168.20.0/24 network from any machines on the 192.168.1.0/24 network.

Any recommendations would be helpful.

Improve this question
2
  • 1
    Could you make a drawing of what you have set up? Are you using VLANs? And would it be an option to have the ASA do the routing?
    – Gerben
    Commented May 22, 2015 at 21:23
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 11, 2017 at 16:49

4 Answers 4

Reset to default
2

Just because you have two interfaces on a server in different subnets doesn't mean that the server will route packets between the two. Think of what a huge security hole it would be if that's how it worked!

Since you have an ASA and what sounds like managed switches, I'd highly recommend segmenting the network into two VLANs, doing a 802.1q trunk to the ASA, and having the ASA route between the two subnets on the two VLANs. You'd just have all your PCs point to the ASA interface on its local VLAN as its default (all addresses) gateway.

Improve this answer
1
  • Oh, the nostalgia! In IPX networks, servers were routers, too. It is very possible, and easy, to have a router and/or switch process running on a server - especially a *nix server. Although, that is usually discouraged or banned in an enterprise network.
    – Ron Maupin ♦
    Commented May 23, 2015 at 13:16
1

The problem with your configuration is that the default gateway for PCs on the 192.168.1.0 network is the ASA. So they have no route to the 192.168.20 network. To make this work:

  1. Change the default gateway of all the PCs on the 192.168.1.0 network to be the IP of the server.
  2. Create a static default route on the server pointing to the ASA

However, I agree with the other answers that this is not a good option and that using sub-interfaces and VLANs is a better way to go.

Improve this answer
0

Implement Ethernet subinterfaces on the ASA, an 802.1q trunk to the LAN. Both subnets can exist on a single VLAN or your can deploy 2 VLANs on the LAN.

Improve this answer
0

Simply use IP network 192.168.0.0/16 instead of /24. It's a matter of changing some configuration but it can be done very quickly.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.