diff --git a/src/com/google/enterprise/adaptor/Config.java b/src/com/google/enterprise/adaptor/Config.java
index 4382353..b2792e2 100644
--- a/src/com/google/enterprise/adaptor/Config.java
+++ b/src/com/google/enterprise/adaptor/Config.java
@@ -94,6 +94,10 @@
  *     in feed files. Defaults to  UTF-8
  * <tr><td align="center"> yes </td><td>gsa.hostname </td><td> machine to
  *     send feed files to.  Process errors if not provided 
+ * <tr><td> </td><td>gsa.admin.hostname </td><td> administrative host for
+ *     the GSA. This may be different from gsa.hostname if the GSA's dedicated
+ *     administrative network interface is enabled. Defaults to the same
+ *     value as gsa.hostname.
  * <tr><td> </td><td>gsa.samlEntityId </td><td> The SAML Entity ID that
  *     identifies the GSA. Defaults to
  *     http://google.com/enterprise/gsa/security-manager
@@ -206,6 +210,7 @@
     addKey("server.useCompression", "true");
     addKey("server.samlEntityId", "http://google.com/enterprise/gsa/adaptor");
     addKey("gsa.hostname", null);
+    addKey("gsa.admin.hostname", "");
     addKey("gsa.characterEncoding", "UTF-8");
     addKey("gsa.version", "GENERATE");
     addKey("gsa.614FeedWorkaroundEnabled", "false");
@@ -272,6 +277,16 @@
 
   /* Preferences suggested you set them: */
 
+  /**
+   * If your GSA has a dedicated administrative network interface configured,
+   * this is hostname for that GSA's admin NIC.  If not set, defaults to the
+   * same as gsa.hostname.
+   */
+  String getGsaAdminHostname() {
+    String hostname = getValue("gsa.admin.hostname").trim();
+    return (hostname.length() > 0)? hostname : getGsaHostname();
+  }
+
   String getFeedName() {
     return getValue("feed.name");
   }
diff --git a/src/com/google/enterprise/adaptor/Dashboard.java b/src/com/google/enterprise/adaptor/Dashboard.java
index e74314c..bc68dcf 100644
--- a/src/com/google/enterprise/adaptor/Dashboard.java
+++ b/src/com/google/enterprise/adaptor/Dashboard.java
@@ -102,7 +102,7 @@
       HttpHandler handler, Config config,
       SessionManager<HttpExchange> sessionManager, boolean secure) {
     return new AdministratorSecurityHandler(handler, sessionManager,
-        config.getGsaHostname(), secure);
+        config.getGsaAdminHostname(), secure);
   }
 
   public void stop() {
diff --git a/src/com/google/enterprise/adaptor/Service.java b/src/com/google/enterprise/adaptor/Service.java
index c371356..2ca98b0 100644
--- a/src/com/google/enterprise/adaptor/Service.java
+++ b/src/com/google/enterprise/adaptor/Service.java
@@ -196,6 +196,7 @@
                 // DISABLES ALL SECURITY.
                 "-Dserver.fullAccessHosts=127.0.0.1",
                 "-Dgsa.hostname=" + config.getGsaHostname(),
+                "-Dgsa.admin.hostname=" + config.getGsaAdminHostname(),
                 "-Dserver.reverseProxyProtocol=" + scheme,
                 "-Dserver.reverseProxyPort=" + config.getServerPort()));
             if (ret != 0) {
diff --git a/test/com/google/enterprise/adaptor/ConfigTest.java b/test/com/google/enterprise/adaptor/ConfigTest.java
index 4556a9f..639d0f4 100644
--- a/test/com/google/enterprise/adaptor/ConfigTest.java
+++ b/test/com/google/enterprise/adaptor/ConfigTest.java
@@ -123,6 +123,20 @@
     assertEquals("notreal", config.getGsaHostname());
   }
 
+  public void testAdminHostname() throws Exception {
+    configFile.setFileContents(
+        "gsa.hostname=feedhost\n" + "gsa.admin.hostname=admin\n");
+    config.load(configFile);
+    assertEquals("feedhost", config.getGsaHostname());
+    assertEquals("admin", config.getGsaAdminHostname());
+  }
+
+  public void testNoAdminHostname() throws Exception {
+    configFile.setFileContents("gsa.hostname=feedhost\n");
+    config.load(configFile);
+    assertEquals(config.getGsaHostname(), config.getGsaAdminHostname());
+  }
+
   // TODO(ejona): Enable test once config allows gsa.hostname changes.
   /* **DISABLED** @Test*/
   public void testConfigModifiedInvalid() throws Exception {