Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA 5585 with Two Outside networks and one Inside

I have two class C IP blocks that terminate on my router.  I currently have been using an ASA 5520 to provide DMZ VLANs from one of those IP blocks and ignoring the other one.  I am migrating to a 5585 now and want to add the second IP block as a series of VLANS.  The current config is:

IP Addressing is as follows (not my real IPs, but representative of actual setup.

IP Blocks

     External: and

Router inside interface address has both IP blocks set up as a primary and a secondary Address on the inside interface.  Inside interface is

Current ASA 5520 has an address in the first IP block as my outside interface on GigE0/0

Gig E/01 is connected to my core switch and has an IP address on the internal block  (core switch acts as a router for internal networks)

Gig E/02 has several DMZs set up in the same IP block as the outside interface of the ASA and  These are fed into my VSphere clusters as a trunk.

I'm assuming that I can move the existing config to the 5585 (working through the issues around updating to new code) and add the second IP block to GigE0/3 and then create my vlans/sub interfaces on GigE/04.  Gig E/03 will be  (there are other devices on that IP block)

I think my two questions are, am I assuming correctly, and how do I set up a static route so that devices on GigE0/4 go out through GigE0/3 as their gateway because I want my corporate traffice to go through Gig E0/0 and my DMZ traffic that is mostly dev stuff to go through Gig E/03

I'm sorry if I sound like an idiot, i've done all the LAN work and have no problem with VLANs or getting things/keeping things running, but this one I figured i'd get some advice on.




ASA 5585 with Two Outside networks and one Inside

Because ASA's do not support Policy Based routing, i would use NAT.

so NAT between ge0/4 and ge 0/3

Even better, as you will be deploying a new 5585, use 2 contexts, one for Prod and one for DEV

Please remember to rate useful posts, by clicking on the stars below.

New Member

ASA 5585 with Two Outside networks and one Inside

I think the two security contexts is a good idea.  Time to hit the books again.  Thanks.

New Member

ASA 5585 with Two Outside networks and one Inside

Turns out that I cannot do this. I have to provide VPN via ipsec and anyconnect on one of the interfaces on the production side. I have 18 vlans on the second class C and I can ping my interfaces, but once there they don't know where to go. Obviously a routing issue. I have network identities for each network and device and have set up my NAT rules in a manner which I think is right.

This device is using 8.4 code