you will need to create some layer 2 interfaces and allocate them in the context build - you cannot allocate the physical interfaces; in routed mode anyway

seems like you could almost do this with vacl's - due to the secondary addressing i believe you are correct and the FWSM may not do what you want

they must be matched - including licensing - do this at the root (sys)sh fail histthis should give you a clue

you might also consider putting secondary addresses on the hosts that cannot have the ip address replaced -