Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to add wireless capabilities in a few of our remote locations. We have ASA5505s creating an IPSEC tunnel back to a ASA5510. We are currently only using 2 of the 3 available VLANs on the ASA.

I am hoping to configure the DMZ interface as VLAN3 and assign it to e0/1 for example and have one of the LAN ports on the E2500 hook directly to that. Since I am not using the WAN port on the E2500 it should treat it as a AP instead of a full-fledged Router.

That being said I am dedicating a small pool of addresses from the ASA for the wireless clients that end up connecting through the E2500, keeping the ASA as the DHCP server.

Essentially I want to be able to manage the E2500 and make changes, but have only Internet access for the clients connecting through the E2500.

Any ideas? Possible with an ASA and Router?

share|improve this question

There are a few things that you need to consider.

  • The ASA 5505 with the base license only allows full access between 2 Vlans. The 3rd Vlan(DMZ by default) can only access the outside Vlan, but the Inside vlan can access the DMZ. Does that make any sense? It doesn't make any sense to me either.
  • You also need to make sure that your DHCP server is disabled on the E2500 and that the WLAN is able to access the LAN.
  • You will probably also need to add a static IP to the LAN interface on the E2500.

If you take all of that into consideration and the E2500 supports bridging the LAN and WLAN it should work fine.

share|improve this answer

The setup you propose will work, as far as the ASA is concerned.

I have had trouble getting a LinkSys Access Point to pass DHCP requests through to the ASA consistently - sometimes it worked, and sometimes it didn't.

I ended up connecting the WAN port on the AP to the ASA, and using a different subnet for the WiFi network. Allowing access to the web interface of the AP via the WAN interface meant it could be configured remotely.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.