When we originally signed up with our ISP, we requested 30 usable public IPs for use on our Cisco 3600 series router. Currently I have my serial interface configured on the router along with one interface on the first subnet assigned to us. We have now requested a second set of public IPs to accommodate growth and I'm wondering what I need to do to get traffic flowing over the new IPs. The 2nd block of IPs are non-contiguous from the first set and I'm guessing I need to create an interface with one of the IPs from the new block? As it stands right now, if I do a traceroute to one of the new IPs it bounces back and fourth between the ISP and my router serial interface. Here's a basic rundown: (IPs modified for security purposes)
ISP Serial IP: 10.10.10.73/30
CPE Serial IP: 10.10.10.74/30
LAN IP Block 1: 10.20.20.176/28
Router IP: 10.20.20.177/28
Firewall IP: 10.20.20.178
LAN IP Block 2: 10.130.70.192/26
It appears from the traceroute to an IP on the new block that the ISP is routing the new subnet to the serial interface rather than my firewall interface and therefore my router is going to need an IP on the new subnet? My problem with that is I don't have a physical interface available, can it be done with a virtual interface?
traceroute to 10.130.70.193 (10.130.70.193), 64 hops max, 40 byte packets
1 results removed
2 results removed
3 results removed
4 results removed
5 results removed
6 results removed
7 results removed
8 results removed
9 results removed
10 * * *
11 results removed
12 10-10-10-74.dia.static.qwest.net (10.10.10..74) 65.082 ms 67.250 ms 65.736 ms
13 10-10-10-73.dia.static.qwest.net (10.10.10.73) 66.694 ms 68.474 ms 76.452 ms
14 10-10-10-74.dia.static.qwest.net (10.10.10.74) 72.039 ms 68.509 ms 89.042 ms
The trace continues flopping between the same two interfaces on hop 13 and 14 (qwest side and my side serial interfaces of the DS3)
Just to elaborate a bit more on what Jon and Giuseppe said...
You have to understand how routing works.
The ISP has assigned you this new subnet, which means that they own it and they route for it. It is native to their routing domain. So, their edge router probably has a static route that points to your edge router for the new subnet they assigned you, and they are then advertising that back to their core. This is why traffic destined for this new subnet knows how to reach your router.
But then your router has only one static route and it is a default route pointing OUT to the ISP. This is why you see the routing loop. The ISP sends to you, you send to it, and on and on.
The other subnet does not have that problem because there is an interface on your edge router in the subnet, so there must be a routing entry in the route table that says that that subnet is "directly connected." If so, then the "routing" ends and the "switching" begins, ie ARP requests, layer 2 addresses, etc.
You can do the same with this new subnet, but as Giuseppe points out, you certainly dont have to. Just tell your edge router what to do with the traffic destined for the new subnet when it receives it, ie, the static route that will point inward to your ASA that Giuseppe recommended.
By the way, to save that routable IP address from the old subnet - since it seems that you need many of them and they are scarce -- you can remove it from your router's Ethernet interface and replace it with a private address. To be able to route the traffic for the subnet, just make sure you configure a new static route for the old subnet that also points inward to your ASA, since, by removing the IP address from the ethernet interface, you will have killed the "directly connected" route to the old subnet.
I hope I didnt confuse you more. :-)
So, what you'll end up with are 3 static routes: 1 default route pointing OUT, and two static routes for each subnet pointing IN toward your ASA's outside interface.
I neglected to mention that if you do migrate to a private address on your g0/0 interface and use a static pointing to the ASA, as it is recommended you do for the new subnet, you will have to change the IP address of the ASA's outside interface to0 and place it on the same subnet as G0/0, ie, 10.10.10.1/30 for G0/0 and 10.10.10.2/30 for ASA outside.
IP routing works hop by hop it is your border router that needs an additional static route to the ASA outside interface
ip route new-block mask asa-outside-ipaddress.
After this you can allocate the ip addresses of the new block using static NAT pairs as suggested by Jon in the thread you have referenced.
Hope to help