Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A Cisco ASA out of the box is licensed for 2 ½ VLANs.

  • One VLAN for the outside (public) network
  • One VLAN for the inside (private network)
  • A third VLAN which is restricted to be able to talk to either the inside VLAN or the outside VLAN, but not both.

This third VLAN is often used for a guest wireless network, which has access to the internet but no access to your internal network. So we configure port 0 on the ASA on the outside VLAN and give it an IP address of say Then we configure port 1 on the ASA on the inside VLAN and give it an IP address of The guest VLAN we configure on port 2 and give it

I connected port 0 to the upstream router from your ISP and port 1 and 2 directly to a main switch. We have several edge switches around your company that connect to the main switch with fiber uplinks. In theory you should be able to plug a computer into any switch in the company, manually assign it an IP address of with a default gateway of and you should be able to get to the internet.

I have tried this and it either doesn’t work at all or works very slowly. Any thought other then configuring VLANs?

share|improve this question

You need to configure your switch ports PVID to the VLAN they belong to, or configure each device to tag its packets for a particular VLAN (not common).

As an alternative, if you have two separate switches, you can designate one for the private VLAN and one for the guest VLAN.

Please post additional info on your switch config and we can help you narrow down the issue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.