As part of the push to conserve internet addresses, my ISP again asked me to change the IP address of my host - an ASA 5505.

The question is: how do I, without out-of-band access do this without locking myself out?

Bearing in mind that the change entails, changing the external IP of the device AND changing the default route?

  • Note: The ISP set up their gateway with two IPs on the same interface (both the old and the new).
    – xirt
    Commented Jul 22, 2015 at 2:10
  • What code version ASA were you using? Was it prior to 8.4.5? The reason I ask is I ran into this exact issue in the past, and the fix action you posted may have worked, but probably did not work for exactly the same reason you thought it did...
    – Eddie
    Commented Jul 22, 2015 at 19:24
  • 8.4(3). Please elaborate, I'm curious.
    – xirt
    Commented Jul 25, 2015 at 4:22

1 Answer 1


I am posting this on stack exchange as I was unable to find an answer on the 'net:

Where the new subnet is:

  • A.B.C.0 (gateway=A.B.C.1, host ip=A.B.C.2)

and the old subnet is:

  • P.Q.R.0 (gateway=P.Q.R.1, host ip=P.Q.R.2).

1. Save the existing configuration:

copy running-config startup-config

2. Set a reload timeout (for 10 minutes) - in case you do lock yourself out.

reload in 10

3. Add a same-priority default route alongside the existing one:

ip route A.B.C.1 1

4. Now the moment of truth, change the outside address:

interface vlan2
  ip address A.B.C.2

at this point, your connection should drop, and you should reconnect to the new address... if not, wait for the reload, and try again :-)

5. Clear up the old configuration

no ip route P.Q.R.1
reload cancel

6. Save the new configuration

copy running-config startup-config

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.