I'm running a Cisco ASA5520. I could have sworn I had this set up when I installed the system and checked the right boxes in the "Wizard" in Cisco's ASDM, but data only goes from port to port if it gets nat'd and goes out Port0 (internet). The other ports are for the wired network, the wireless network, and the last I'm saving for a fileserver if we add one (its a home network).

So ... what magic is required to say, SSH from the wired network on x.x.11.0 to an IP on the wireless x.x.12.0? And will that be enough to do SMB shares? I remember that there was some issue with the smb protocol not wanting to span subnets and some voodoo was needed to get it to work??

  • You don't have a switch?
    – ewwhite
    Sep 21 '14 at 22:53
  • Doesn't really answer the question. That works around the question. It is capable of routing traffic between ports. And there are advantages to keeping things on separate ports and selectively routing the traffic with firewall rules. A switch would allow all traffic from all addresses. Sep 23 '14 at 2:30
  • I'd be using a switch and trunking vlans to the firewall rather than using the (4) interface ports in this manner. But I wasn't answering the question. Just curious about why a switch wasn't in the picture.
    – ewwhite
    Sep 23 '14 at 2:36

Its a test configuration at my house. The intent is to learn it. I found the answer elsewhere so I'll share it here.

The ASA must be given static NAT rules to pass data from one interface to the other, using the network address of the interface - in other words a rule that says to route using its own IP. This means that every combination of ports has another rule. To pass data from ports 1 and 2, which I have named mcp-wired ( and mcp-wireless ( you would issue the following command : static (mcp-wired,mcp-wireless) netmask static (mcp-wireless,mcp-wired) netmask

If using the GUI/ADSM, go to the NAT section add a rule, and you can see how the information goes into the boxes.

SMB Shares requires a WINS server in the DHCP configuration which means that the WINS server can't have a DHCP assigned address. Its too bad you can't assign "static" IPs via DHCP to specific MAC addresses (keeping configuration information global) or if you can, I don't see where. I've not tested the SMB functionality since I don't want to go to the windows machine to tell it to renew its lease - I HATE touching Windows!

Not the answer you're looking for? Browse other questions tagged or ask your own question.