I am trying to get some clarification on how things should/can be done.

I have 5 static ip's and need to get some servers direct access and some indirect access.

I need to know is it possible to put a vlan on the external wan connection and directly pass traffic to servers on the same vlan if they need an external ip or am i stuck with using static nat/pat for such cases and have the wan interface have a pool of ip's. is there a need for a vlan to have an external ip for routing or will it be enough with the wan port being assigned an ip?

The voice server I am using specifically states it should use nat to connect to the internet. where as some of the other services are wanting an external ip on the system to work properly.

The cisco documentation I have been able to find as well as the ccna books are vague about these points.

  • Is your router interface in the same subnet as your 'static' IPs? Also, do you have a firewall between your servers and the Internet?
    – Ron Trunk
    Commented Aug 23, 2017 at 14:46
  • the 881 is a border firewall/router device. it has a wan port fa4 which is specific to external connections.
    – Kendrick
    Commented Aug 24, 2017 at 12:23

2 Answers 2


While it is possible to put servers on the external (i.e., public facing) subnet, it makes your servers more vulnerable to attack. A more secure way is to put your servers in a DMZ subnet on another router interface. You can then use NAT as required.


If you have a L2 device on between the ASA and the servers you can assign a private IP range on the ASA, this would allow the servers to communicate to one another. If external clients need access to the servers you can assign NAT/ PAT at the ASA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.