I want to setup a 5520 on my network. The basic physical topology is

Cable modem -> router -> internal network currently.

I want to add the 5520 after the router. What is the best way to setup the ASA? Because the original default gateway (192.168.1.x) will now be on the external interface of the ASA. Should I configure the DHCP server to have a new default gateway and match it to the ASA ip for the internal interface and NAT out the rules from there? Likewise have the router pass all data to the external interface of the firewall?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Apr 1, 2018 at 19:59

2 Answers 2


I hope I understand your network and idea correctly as below:

Cable modem => router (192.168.1.x) => (out - 192.168.1.y) ASA (in - New_subnet_IP.A) => internal network.

Yes, you should have new DHCP range (New_subnet) for your internal network with the IP address IP.A (ASA inside IP address) is new default gateway.

You have to make further changes as:

  • ACLs on ASA for traffic from internal network to reach the outside/Internet.
  • Default route on ASA with next-hop is Router (192.168.1.x) on outside interface.
  • Route for internal network on Router with next-hop is ASA (192.168.1.y).
  • NAT rules on Router to cover both current and new internal subnets. You should avoid doing NAT on ASA because all of its interfaces use private IP addresses.

I hope it is helpful and you can get it worked.

  • I could just change the subnet of the router to ASA as well couldn't I i.e. a 10.10 for example? Then modify the ASA internal port to the 192 subnet. The current network Has the router as the 192.168 subnet internal with the dhcp pointing to the IP
    – Afmiller
    Jan 25, 2018 at 15:08
  • @Afmiller Yes, it is absolutely fine to move the current internal network to the right of ASA :)
    – Hung Tran
    Jan 25, 2018 at 15:52
  • @Afmiller Please let me know if you have any further concerns regarding the question. If not, please mark it as the answer. Thanks!
    – Hung Tran
    Feb 2, 2018 at 13:05

You could also set it up in transparent mode instead of routed mode, then you wouldn't need a new subnet on the inside.

Cable modem => router (192.168.1.x) => ASA (Transparent) => internal network (192.168.1.X)

A quick search on Google should give lots of results for a basic config.

Here is a good video about it.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.