2 lan 2 wan asa 5505 cisco how to how to#
2 lan 2 wan asa 5505 cisco how to upgrade#
2 lan 2 wan asa 5505 cisco how to mac#

Even though this post was examplified using one ASA5505 it should work just fine on other ASAs and even on PIXes.

2 lan 2 wan asa 5505 cisco how to how to#

I hope this post will help other peoples that have the same frustration and will show them how to use any number of secondary ip they want. If this is not acceptable, you should then go ahead and use the vlan method. Note: the only limitation this method has is that the вЂsecondaryвЂ™ ip will work as expected as a gateway for the systems behind the asa, but will obviously not respond itself to network requests (like ping for ex.).

2 lan 2 wan asa 5505 cisco how to upgrade#

LetвЂ™s try to speculate why doesnвЂ™t Cisco want this вЂfeatureвЂ™ in their firewalls? Maybe because on the standard license the box doesnвЂ™t support more than 2 full vlans (and 1 DMZ - limited)? and so you canвЂ™t do this using vlans even if you wantedвЂ¦ And you have to buy a license upgrade to support more? Or just to trunk them? What do you think? Do you think this is intentional to make peoples buy their higher end ASAs or upgrade to Security Plus license? (about 400-500$ extra)? The вЂњCisco wayвЂќ to achieve this is to use separate vlans for each network range. Same-security-traffic permit intra-interfaceДЄnd you probably want to be sure that access lists will allow the traffic from/to the newly added network. Same-security-traffic permit inter-interface

2 lan 2 wan asa 5505 cisco how to mac#

first find out the mac address of the ethernet interface you will be using.In my example I will be using eth0/1 and the вЂinsideвЂ™ vlan, vlan1 with an existing вЂmainвЂ™ ip range configured: 192.168.0.1/24 I will add another ip 192.168.1.1 so hosts from this range will also work behind the ASA: LetвЂ™s see what trick we can use to overcome this stupid limitation: we will be using the Proxy-ARP facility in order to respond for another IP requests on the same ethernet interface, without actually bringing it up. You could try out to use the familiar ios command to add a secondary ip on the interface/vlan, as you might hope it is undocumented feature, but you will see it is just not thereвЂ¦ Still the ASA will not be able to do this. I will not give a linux system as an example as this is quite obvious to anyone that you can add as many ip aliases you want on one ethernet interface. Now, why would I need this? Maybe I have several network ranges behind the ASA, and for whatever reason I donвЂ™t need them in separate vlans (my switches donвЂ™t support vlans, I have ips from both ranges configured on some systems, etc.) and I donвЂ™t what to pay a lot of money to just enable more vlans on the box, etc. Well, it costs much more than any other similar hardware firewall and honestly every other box I have seen support this (I canвЂ™t even call it feature)вЂ¦ I canвЂ™t be certain as I donвЂ™t have such a device to test out, but from what I can tell, all the ASA product line has the same issue, including the higher level 55. You could say that the 5505 is the cheapest models and this is the reason for the limitation. Again this was many years agoвЂ¦ Today when I had to configure a small Cisco ASA 5505 device, I didnвЂ™t even thought that the fanciest line of Cisco firewalls still has this limitation. This post will show how to overcome the frustration on the top line Cisco ASA firewalls not supporting interface ip aliases.Д¬isco PIX firewalls have been around for many years and I was aware of the stupid limitation they had about not being able to add ip aliases on their interfaces. Sill, from time to time I take on small consulting Cisco related projects. Even though I hold a valid CCNP, I didnвЂ™t had the chance to work during the past months with Cisco devices as much as I was when I was actively working in the ISP field. I have been working with various Cisco devices for many years now.