ASA 5505 outside IP address overlapp with inside

[mljevakovic]

This is our situation. On the outside interface we have  ip add 10.1.1.22 which we translated in ip add 10.1.2.22 on inside interface. Also this host on LAN 10.1.2.11 has secondary address 10.1.1.22. How configure on ASA when internal clients ping or access to 10.1.1.22  use it on inside interface not going to outside. Note: other similar devices use alias command. Is ti possible configurie on ASA?

Any help!

[August Ritchie]

Hello,

It looks like what you are wanting to do is a u-turn/hairpinning. This is also assuming you are running 8.2 or earlier.

From what I gather you need to ping a device with two IP addresses:

1. To its primary IP 10.1.2.11 (This works now I assume)

2. To its secondary IP 10.1.1.22 (This does not work, again assumption)

but the problem right now you don't want it to take the default route outside when pinging 10.1.1.22.

For the sake of example, lets say 10.1.2.11 is on the inside and we want to u-turn on this interface.

Here is the configuration we would need.

same-security-traffic permit intra-interface //This allows us to go from inside to inside

nat (inside) 1 0.0.0.0 0.0.0.0 //Most configurations already have this just make sure that the nat ID (1 in this case) matches the global below

global (inside) 1 interface //This allows the ASA to act as a proxy between the hosts to avoid asymmetric routing

static (inside,inside)  10.1.1.22 10.1.1.22 netmask 255.255.255.255 // This is used to do identity destination NAT

You can see another example of this configuration below

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml#solution2