I have a Question. We actually have a Cisco 1812 Router and we're Switching to an ASA 5512-X. The Problem is, the ASA 5512-X only has 6 Ports. The 1812, had 8. All in use.

We need to translate 3 Public IP Adresses into our Private IP Adresses for our Servers in the DMZ. We also need the other Ports. Our Situation now is, that the 3 IP Adresses are translated from the Router. But with the ASA we don't have enough Ports for this.

My Question is, can I "forward" those 3 IP Addresses from the ASA over the BLUE Port (in my Picture) to the Switch (I think i need Layer3 for this?!) and the Switch does the Translation?

The Translation should be: Public IP A,B or C comes in from the Internet to the ASA, get forwarded to the switch and the switch translates it to the correct private IP. Public IP A to Public IP B.

I have asked this in another Forum and got the answer, that an ASA can't replace a Router. Yes this is right but we don't need much functionality.

We have 4 seperate subnet. One DMZ. And three AP with two different VLAN. Thats all. And you see, this er six ports. 4 for our subnets, 1 for WIFI (I Hope i can only use one for 3 APs) and 1 for DMZ.

Are their any other solutions? Maybe using a normal router? a newer one, not the 1812.


3 Answers 3


Back on the stage :) One small and unimportant detail: according to Cisco, one model of 2960 is Layer 3 capable - 2960XR.

Speaking about your possible configuration, it woud be nice to have two additional switches (vlan capable, not dumbs). I'd use 4 interfaces: "outside", "inside", "DMZ" and "wifi".

"Outside" link goes to your ISP;

"DMZ" - to the DMZ switch with the servers;

"WIFI" connects to the additional wifi network switch. Here you define subinterfaces for 2 wifi vlans. On the switch side corresponding port should be in dot1q trunk mode. Probably you'd need WIFI AP to be in trunk mode too.

"Inside" goes to the second additional switch, which is connecting your internal subnets; define here subinterfaces for the subnets and put switch's port into trunk mode.

One example of such configuration (alas, without the switches): https://www.speaknetworks.com/cisco-asa-dmz-configuration-example/

  • I completely agree with using four ports. That's my plan. Outside goes to ISP - agree DMZ goes to seperate switch as the other networks. Not nice cause there are only 3 Servers in DMZ and using a own switch would be waste of money !? I will need for my inside network about 80 Ports. So i would like to have DMZ, the other 3 subnet (not the and the wifi ports on one Switch. Feb 2, 2016 at 14:35
  • PS: The link is exactly what i am looking for! Thx! I mark your answer as correct because it helped me a lot! Feb 2, 2016 at 14:37
  • IGlad it helped you. If you feel using the entire switch for the DMZ is a waste, you could do a simple trick - create there an isolated vlan (e.g vlan 999) and put 4 ports into it. Do not trunk it anywhere, it is simply isolating 4 ports from the rest of the switch. Connect there your 3 servers and DMZ interface of ASA, that's it.
    – Muti Onu
    Feb 5, 2016 at 13:43
  • i have figured this out :) thanks to google :P i will do this! I am ordering the ASA and the Switch next week and i will go for a CCNA course :P i really like this topic! :) Feb 6, 2016 at 22:33
  • Altough I have a Problem. I have made two vlan (10,20) assigned. Assigned them two 4 Ports on the switch (One Port to ASA, 3 to Servers). So i am using 8 ports. I am able to ping inside to VLAN (not the problem) but i am not able to ping into the other Vlan. I am doing this in Simulation Tool. The "Package goes to the ASA" but is there thrown away. I thought that when the ASA is connected to both VLANS, they can communicate. PS: If you still reading this you're god! :D Feb 8, 2016 at 12:24

In fact, you could implement a solution with the servers connected to the switch with your old router too. I mean, you could connect the switch to one of the router's port, have 2 ports free, and servers connect through the switch. I hope you agree that the need for NAT does not mean that every NAT-ed device must use an individual port on the router/ASA?

So, IMO the place for doing NAT should be ASA and your switch could be Layer2.

Put one ASA's port into your DMZ, give it appropriate security level, connect there the switch, tell the servers to use ASA's DMZ port as a gateway and you are done. Oh, the NAT rules, of course, - not too hard with ASDM.

I think, the rest of your configuration could be somewhat optimised too (in the part of using ASA's ports), but let's stop here.

  • I forget to explain, that the other Ports should be in another subnet. Like the DMZ inside IP is and the other Ports should be in the Subnet Maybe the solution is VLAN? But if the place for doing NAT is ASA, ASA sends the nat-ed IP to Switch and this Switch can handle it? Our actual Router is EOL so we need to change :) Jan 28, 2016 at 13:59
  • If you need to use the same 2960 switch for both subnets, yes, you could separate them with a pair of vlans. If you have more switches and connect one of them to your "inside"interface, you could live without VLANs. You wrote you have 4 subnets + dmz + wifi, now I see only two, which is right?
    – Muti Onu
    Jan 28, 2016 at 14:28
  • Well, I do not know the size of your network and how it worked with 1812 router and without vlans. I think it is possible that every subnet was physically isolated and the subnets met only on 1812, am I right? And the router did DHCP for all the subnets? Chat - I must leave in 5 min and be online only tomorrow morning.
    – Muti Onu
    Jan 28, 2016 at 15:11
  • Okay - I have enough time overthinking the network. So it would be nice to hear you again. It seems you have a lot of knowledge :) Jan 28, 2016 at 15:36

First off, in your picture you show a 2960 switch, I am not aware of any 2960s being layer 3, they are all layer 2.

You can use a 2960 layer 2 switch her to meet all your needs. On the ASA, all of the inside networks can share a single port, using sub interfaces with VLANs. You set your switch to a trunk port with the appropriate allowed VLANs and you can then assign the appropriate ports on the switch to access the appropriate VLAN.

  • Thanks. So in conclusion, i can buy the ASA und the switch and i will be happy? Why do i need a trunk port? sorry - i am really newbie. But google helps me a lot, but not now. Jan 28, 2016 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.