ip address [ip] [mask] secondary
Assigns a secondary IP address to an interface, allowing the interface to be reachable on multiple subnets simultaneously.
Definition: ip address [ip] [mask] secondary is a Cisco IOS interface config command. Assigns a secondary IP address to an interface, allowing the interface to be reachable on multiple subnets simultaneously.
Overview
The `ip address [ip] [mask] secondary` command is a Cisco IOS interface configuration command that assigns a secondary IP address to an interface. This allows a single physical or logical interface to be reachable on multiple IP subnets simultaneously. The primary IP address is configured with the `ip address [ip] [mask]` command (without the `secondary` keyword), and any additional addresses are added using the `secondary` keyword.
This is useful in scenarios where a router needs to serve as a gateway for multiple subnets on the same broadcast domain, such as in a multihomed network or when migrating subnets without changing the default gateway of hosts. The command does not create a separate logical interface; instead, the interface responds to ARP requests for all configured IP addresses. It is important to note that the secondary address must be in a different subnet from the primary address and any other secondary addresses on the same interface.
The command is available in privileged EXEC mode (configure terminal) and requires at least privilege level 15. Changes take effect immediately and are written to the running configuration. This command is often used in conjunction with HSRP, VRRP, or GLBP for first-hop redundancy, where each virtual IP address can be a secondary address on the interface.
It is also used in NAT scenarios where an interface needs to be reachable from multiple inside networks. Compared to using subinterfaces, secondary IP addresses are simpler but less flexible; subinterfaces allow separate routing decisions per VLAN, while secondary addresses share the same routing table entry for the interface. The command is supported in all Cisco IOS versions, including 12.x, 15.x, and 16.x, as well as IOS-XE.
In NX-OS, the equivalent is `ip address [ip] [mask] secondary` under interface configuration mode, but NX-OS also supports multiple IP addresses without the `secondary` keyword by simply adding them. The command is not available in IOS-XR, which uses a different model for multiple IP addresses on an interface. Understanding this command is critical for CCNA and CCNP candidates as it appears in exam topics related to IP addressing, interface configuration, and troubleshooting connectivity issues in multi-subnet environments.
ip address [ip] [mask] secondaryWhen to Use This Command
- Connecting a router to a network that has run out of IP addresses in the primary subnet, requiring an additional subnet on the same VLAN.
- Migrating a network from one IP subnet to another without disrupting connectivity, by adding the new subnet as secondary before removing the old one.
- Providing redundancy by having two different subnets on the same interface for failover or load balancing.
- Allowing a router to act as a gateway for multiple subnets on a single physical interface, such as in a multitenant environment.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| ip | A.B.C.D | The secondary IP address to assign to the interface. Must be a valid unicast IPv4 address. Common mistake: using a broadcast or network address, or an address already configured as primary or secondary on the same interface. |
| mask | A.B.C.D | The subnet mask for the secondary IP address. Must be in dotted decimal format (e.g., 255.255.255.0). The mask must be consistent with the subnet of the IP address. Common mistake: using a mask that overlaps with the primary subnet or another secondary subnet on the same interface. |
Command Examples
Assign a secondary IP to GigabitEthernet0/0
interface GigabitEthernet0/0
ip address 192.168.1.1 255.255.255.0
ip address 10.0.0.1 255.255.255.0 secondaryRouter(config-if)# ip address 192.168.1.1 255.255.255.0 Router(config-if)# ip address 10.0.0.1 255.255.255.0 secondary Router(config-if)# end Router# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.1.1 YES manual up up GigabitEthernet0/0 10.0.0.1 YES manual up up
The first command assigns the primary IP 192.168.1.1/24. The second command adds 10.0.0.1/24 as a secondary IP. The 'show ip interface brief' output shows both IPs on the same interface, both marked as 'up'.
Verify secondary IP configuration
show ip interface GigabitEthernet0/0GigabitEthernet0/0 is up, line protocol is up Internet address is 192.168.1.1/24 Broadcast address is 255.255.255.255 Address determined by non-volatile memory MTU is 1500 bytes Helper address is not set Directed broadcast forwarding is disabled Secondary address 10.0.0.1/24 Outgoing access list is not set Inbound access list is not set
The output shows the primary IP under 'Internet address' and the secondary IP listed separately as 'Secondary address'. This confirms both IPs are active on the interface.
Understanding the Output
When using 'show ip interface brief', each secondary IP appears as a separate line for the same interface, with its own IP address and status. The primary IP is listed first, followed by secondary IPs. In 'show ip interface', the primary IP is shown under 'Internet address' and secondary IPs are listed as 'Secondary address' lines.
Both IPs must be in different subnets. If the interface is down, both IPs will show as down. A common issue is overlapping subnets between primary and secondary IPs, which IOS will reject with an error message.
Configuration Scenarios
Configure a router interface to serve as gateway for two subnets
A branch office has two VLANs (10 and 20) on the same switch, but the router has only one physical interface connected to the switch. The router must act as the default gateway for both subnets 192.168.10.0/24 and 192.168.20.0/24.
Topology
R1(Gi0/0)---.1---Switch---Hosts in VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24)Steps
- 1.Step 1: Enter global configuration mode: enable, then configure terminal
- 2.Step 2: Enter interface configuration mode for GigabitEthernet0/0: interface GigabitEthernet0/0
- 3.Step 3: Configure the primary IP address for subnet 192.168.10.0/24: ip address 192.168.10.1 255.255.255.0
- 4.Step 4: Configure the secondary IP address for subnet 192.168.20.0/24: ip address 192.168.20.1 255.255.255.0 secondary
- 5.Step 5: Exit configuration mode and verify: end, show ip interface brief
! Full IOS config block Router> enable Router# configure terminal Router(config)# interface GigabitEthernet0/0 Router(config-if)# ip address 192.168.10.1 255.255.255.0 Router(config-if)# ip address 192.168.20.1 255.255.255.0 secondary Router(config-if)# end
Verify: Use `show ip interface brief` to verify both IP addresses are listed. Expected output: Interface GigabitEthernet0/0 shows IP-Address 192.168.10.1 and also secondary address 192.168.20.1 (though secondary may not appear in brief; use `show ip interface GigabitEthernet0/0` to see all addresses).
Watch out: Ensure the switch ports are configured as trunk or access ports appropriately. If the switch is not VLAN-aware, hosts on different subnets may not be able to communicate through the router unless inter-VLAN routing is configured.
Migrate a subnet without changing host default gateways
An organization is renumbering its network from 10.0.0.0/24 to 10.0.1.0/24. Hosts currently use 10.0.0.1 as default gateway. To avoid reconfiguring all hosts at once, the router interface is given a secondary address in the new subnet, allowing hosts to be migrated gradually.
Topology
R1(Gi0/0)---.1 (old) and .1 (new)---Switch---Hosts (some with old gateway, some with new)Steps
- 1.Step 1: Enter interface configuration mode: interface GigabitEthernet0/0
- 2.Step 2: Configure the primary IP address (new subnet): ip address 10.0.1.1 255.255.255.0
- 3.Step 3: Configure the secondary IP address (old subnet): ip address 10.0.0.1 255.255.255.0 secondary
- 4.Step 4: After all hosts are migrated to the new subnet, remove the secondary address: no ip address 10.0.0.1 255.255.255.0 secondary
- 5.Step 5: Verify: show ip interface GigabitEthernet0/0
! Full IOS config block Router> enable Router# configure terminal Router(config)# interface GigabitEthernet0/0 Router(config-if)# ip address 10.0.1.1 255.255.255.0 Router(config-if)# ip address 10.0.0.1 255.255.255.0 secondary Router(config-if)# end
Verify: Use `show ip interface GigabitEthernet0/0` to see both IP addresses listed. Expected output includes lines: 'Internet address is 10.0.1.1/24' and 'Secondary address 10.0.0.1/24'.
Watch out: Do not forget to remove the secondary address after migration is complete. Leaving it can cause routing confusion and security issues. Also, ensure that routing protocols (if used) advertise both subnets correctly; some protocols may need additional configuration.
Troubleshooting with This Command
When troubleshooting issues related to secondary IP addresses, the primary verification command is `show ip interface [interface]`. This command displays all IP addresses configured on the interface, including secondary addresses. Healthy output will list the primary address and any secondary addresses with their subnet masks.
A common problem is that the secondary address is not appearing; this could be due to a configuration error (e.g., the address is already used elsewhere, or the subnet overlaps with the primary). Another issue is that hosts on the secondary subnet cannot reach the router; this is often because the router's ARP table does not have an entry for the host, or the host's default gateway is misconfigured. Use `show arp` to verify that the router has resolved the MAC addresses of hosts on both subnets.
If the router is not responding to ARP requests for the secondary IP, check that the interface is up and that there is no IP address conflict. Use `debug ip packet` with caution to see if packets are being dropped. Another common symptom is that routing protocols (like OSPF or EIGRP) may not advertise the secondary subnet unless explicitly configured to do so.
For OSPF, the `network` statement under router OSPF must include the secondary subnet, or the interface must be in the correct area. For EIGRP, the `network` command should include the secondary subnet. Use `show ip route` to verify that the secondary subnet is reachable via the correct interface.
If the secondary address is not appearing in the routing table, check that the interface is not in a down state and that there are no access lists blocking traffic. Also, note that secondary IP addresses do not participate in HSRP/VRRP/GLBP by default; if redundancy is needed, you must configure the virtual IP as a secondary address. A step-by-step diagnostic flow: 1) Verify interface status with `show interfaces [interface]` – ensure it is up/up. 2) Check IP addresses with `show ip interface [interface]`. 3) Check ARP table with `show arp` for hosts on both subnets. 4) Check routing table with `show ip route` for the secondary subnet. 5) If routing protocol is used, verify with `show ip protocols` and `show ip ospf interface` or `show ip eigrp interfaces`. 6) Use `ping` from the router to a host on the secondary subnet to test connectivity. 7) If ping fails, use `traceroute` to see where packets are dropped.
Correlate with `debug ip icmp` to see if ICMP replies are generated. Remember that secondary addresses are a layer 3 feature; layer 2 issues (like VLAN mismatch) can also cause problems. Always check the switch configuration if the router is connected to a switch.
CCNA Exam Tips
CCNA exam tip: Secondary IPs are used when you need to have multiple subnets on the same VLAN without using subinterfaces.
CCNA exam tip: The 'secondary' keyword must be used; without it, the command replaces the primary IP.
CCNA exam tip: Secondary IPs are often used in migration scenarios to allow hosts from old and new subnets to coexist.
CCNA exam tip: Remember that secondary IPs do not support DHCP relay; the 'ip helper-address' only works with the primary IP.
Common Mistakes
Mistake: Forgetting the 'secondary' keyword, which overwrites the primary IP and breaks connectivity.
Mistake: Assigning a secondary IP in the same subnet as the primary IP, which IOS rejects with 'overlap error'.
Mistake: Assuming secondary IPs are supported on all interface types; they are not supported on tunnel interfaces or dialer interfaces.
ip address [ip] [mask] secondary vs ip address [ip] [mask]
Both commands assign an IPv4 address to an interface, but the 'secondary' keyword allows multiple IPs on the same interface, enabling multi-subnet access without subinterfaces. This distinction is often confused because both commands appear similar in syntax, yet secondary addresses have different routing and failover behaviors.
| Aspect | ip address [ip] [mask] secondary | ip address [ip] [mask] |
|---|---|---|
| Role | Assigns a secondary IP; primary remains required. | Assigns the primary IP (may be the only IP). |
| Number per Interface | Unlimited secondary addresses allowed. | Only one primary address; use 'secondary' for extras. |
| Routing Table Effect | Installs a connected route for the secondary subnet, but no ARP entry if same VLAN. | Installs a connected route and ARP entry for the primary subnet. |
| Typical Use | Extra subnets for management, NAT, or multi-homing without subinterfaces. | Default address for interface communication. |
| Config Persistence | Persists in running-config; same as primary. | Persists in running-config. |
Use ip address [ip] [mask] secondary when you need the interface to be reachable on an additional subnet without removing the primary address or using subinterfaces.
Use ip address [ip] [mask] when assigning the initial or only IP address for an interface to enable IP communication.
Platform Notes
In Cisco IOS-XE, the `ip address [ip] [mask] secondary` command works identically to classic IOS. The output of `show ip interface` is similar, but IOS-XE may display additional fields like 'Secondary address' in a slightly different format. In NX-OS (Cisco Nexus switches), the command is also `ip address [ip] [mask] secondary` under interface configuration mode.
However, NX-OS allows multiple IP addresses on an interface without the `secondary` keyword; you can simply add multiple `ip address` commands, and they are all considered primary. The `secondary` keyword is optional and used for compatibility with IOS scripts. In NX-OS, use `show ip interface [interface]` to see all addresses.
For ASA (Cisco Adaptive Security Appliance), the equivalent is `ip address [ip] [mask] secondary` under interface configuration mode, but ASA also supports multiple IP addresses per interface. In ASA, the secondary address is used for management access or for routing purposes. In IOS-XR, the command does not exist; instead, you configure multiple IP addresses using the `ipv4 address [ip] [mask]` command multiple times, and each address is considered a primary address.
IOS-XR uses a different interface configuration model. Regarding IOS version differences: In IOS 12.x, the command is fully supported. In IOS 15.x and 16.x, the syntax remains the same, but there may be changes in how the secondary address interacts with features like NAT or policy-based routing.
Always check the specific version documentation. For example, in some versions, NAT may require the `ip nat inside` or `ip nat outside` command to be applied to the interface, and secondary addresses are automatically included. In others, you may need to specify the secondary address in NAT rules.
The command is available in all IOS images that support IP routing, including IP Base and Advanced IP Services. There is no privilege level requirement beyond the standard 15 for configuration. The command is not available in IOS-XE SD-WAN (vEdge) platforms, which use a different configuration model.
Related Commands
ip address [ip] [mask]
Assigns an IPv4 address and subnet mask to an interface, enabling IP communication on that interface.
show ip interface
Displays the status and configuration of all IP interfaces on a Cisco router, including IP address, protocol status, and interface statistics, used for verifying interface IP configuration and troubleshooting connectivity issues.
show ip interface brief
Displays a one-line summary of all interfaces showing the IP address assigned, operational status (up/down), and line protocol status. The fastest way to get a device health overview.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions