1

Im programming a Cisco ASA 5506. I need to add a primary (public) IP that is x.x.x.82/24 and a backup IP that is x.x.x.81/24. The ASA wont allow me to do this as it gives me an error: "the IP address cannot overlap with the subnet of interface outside" when i go to add the backup (public) IP. Is there a reason i cannot do this, and is there a workaround for that?

Im wondering if a possible workaround could be to make the subnet mask for the primary 255.255.255.254 since that contains the .82 - .83 IP's, and make the subnet for the backup 255.255.255.252 since that contains .80 - .83

My naivety may be overlooking something here though. any help is appreciated

Improve this question
9
  • What are you trying to accomplish specifically with that configuration? There's likely an alternative.
    – boomi
    Aug 6, 2020 at 13:05
  • @boomi So i believe the site im configuring it for has a fiber router and DSL modem from the same ISP. I want to configure the outside interface(port 1) to use the fiber router, but should something happen to the fiber, i want it to swing over to the backup interface(port 8) on the DSL modem. but since they are on the same subnet, i cant even add the IP address to the backup interface
    – TechEng
    Aug 6, 2020 at 13:08
  • 1
    Are you sure they have the same addressing? That's very odd that 2 separate circuits would be provisioned with the same address space, especially given that they're different types of connections, even though they may be through the same provider. Are you sure none of the octets are different?
    – Jesse P.
    Aug 6, 2020 at 13:31
  • 1
    Even if they're coming from the same ISP device, I'd expect them to be addressed differently too. Can you double check with the provider? You won't be able to assign addresses in the same subnet to separate layer 3 interfaces on the 5506. You can however look into redundant interfaces cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/…
    – boomi
    Aug 6, 2020 at 19:46
  • 1
    You technically probably could change the subnet mask as you mentioned but that's a really bad way to work around the issue. I'd suggest that you have the ISP either split up the subnet and create a second gateway on their device for you to use with your secondary uplink or get a completely different block of addresses. A lot of the time, you'd have a separate /30 block just for peering and then they just route through that so you aren't wasting addresses in your main scope. So, you could get 2 /30 blocks and then use weights to prefer one path over the other.
    – Jesse P.
    Aug 6, 2020 at 21:11

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.