The following figure shows the recommended network deployment for the ASA 5506-X with the ASA FirePOWER module (supported with ASA 9.9(x) and earlier) and the built-in wireless access point (ASA 5506W-X). This deployment includes an inside bridge group (also known as a software switch) that includes all but the outside and wifi interfaces so that you can use these interfaces as an alternative to an external switch.

The default configuration enables the above network deployment with the following behavior.

• outside GigabitEthernet 1/1 interface, IP address from DHCP

• inside bridge group with GigabitEthernet 1/2 through 1/8 member interfaces (GigabitEthernet 1/2 through 1/4 for the ASA 5506H-X), 192.168.1.1

• (ASA 5506W-X) wifi GigabitEthernet 1/9 internal interface, 192.168.10.1

• inside --> outside traffic flow, which allows inside users to access the outside (internet)

• inside --> inside traffic flow for member interfaces, which allows all inside bridge group member interfaces to communicate

• (ASA 5506W-X) wifi <--> inside, wifi --> outside traffic flow, which allows free communication between the wifi network and the inside network, and allows the wifi network to access the outside (internet)

• DHCP for clients on inside and wifi. Clients receive IP addresses from the ASA. The access point itself and all its clients use the ASA as the DHCP server.

• Management 1/1 interface belongs to the ASA FirePOWER module (supported with ASA 9.9(x) and earlier); this usage requires ASA management from the inside or wifi interface. The interface is Up, but otherwise unconfigured on the ASA. The ASA FirePOWER module can then use this interface to access the ASA inside network and use the inside interface as the gateway to the Internet.

  Note	Do not configure an IP address for this interface in the ASA configuration. Only configure an IP address in the FirePOWER configuration. You should consider this interface as completely separate from the ASA in terms of routing.

• Adaptive Security Device Manager (ASDM) HTTPS access on the inside interface and the wifi interface

• Network Address Translation (NAT): Interface Port Address Translation (PAT) for all traffic from inside, wifi, and management to outside. IP addresses from the private inside, wifi, and management networks will be translated to the public outside IP address plus a unique port number. You cannot route private IP addresses on the internet, so NAT is required.

Note

If you want to deploy a separate router on the inside network, then you can route between management and inside. In this case, you can manage both the ASA and ASA FirePOWER module on Management 1/1 with the appropriate configuration changes. Many network and routing setups are possible using alternative configurations. However, you cannot manage the FirePOWER module using ASDM if you use NAT between your management computer and the FirePOWER management IP address (at least, not without configuring a more complicated VPN setup). When you run ASDM on your computer, ASDM communicates with the FirePOWER module using the real IP address configured on the module, and it does not have the ability to specify a NAT address instead.

The following figure shows the recommended network deployment for the ASA 5506-X with the ASA FirePOWER module and the built-in wireless access point (ASA 5506W-X):

Note	You must use a separate inside switch in your deployment.

The default configuration enables the above network deployment with the following behavior.

• outside GigabitEthernet 1/1 interface, IP address from DHCP

• inside GigabitEthernet ½ interface, 192.168.1.1

• (ASA 5506W-X) wifi GigabitEthernet 1/9 internal interface, 192.168.10.1

• inside --> outside traffic flow, which allows inside users to access the outside (internet)

• (ASA 5506W-X) wifi <--> inside, wifi --> outside traffic flow, which allows free communication between the wifi network and the inside network, and allows the wifi network to access the outside (internet)

• DHCP for clients on inside and wifi. Clients receive IP addresses from the ASA. The access point itself and all its clients use the ASA as the DHCP server.

• Management 1/1 belongs to the ASA FirePOWER module; this usage requires ASA management from the inside or wifi interface. The interface is Up, but otherwise unconfigured on the ASA. The ASA FirePOWER module can then use this interface to access the ASA inside network and use the inside interface as the gateway to the Internet.

  Note

  Do not configure an IP address for this interface in the ASA configuration. Only configure an IP address in the FirePOWER configuration. You should consider this interface as completely separate from the ASA in terms of routing. Adaptive Security Device Manager (ASDM) HTTPS access on the inside interface and the wifi interface Network Address Translation (NAT): Interface Port Address Translation (PAT) for all traffic from inside, wifi, and management to outside. IP addresses from the private inside, wifi, and management networks will be translated to the public outside IP address plus a unique port number. You cannot route private IP addresses on the internet, so NAT is required.

Note

If you want to deploy a separate router on the inside network, then you can route between management and inside. In this case, you can manage both the ASA and ASA FirePOWER module on Management 1/1 with the appropriate configuration changes. Many network and routing setups are possible using alternative configurations. However, you cannot manage the FirePOWER module using ASDM if you use NAT between your management computer and the FirePOWER management IP address (at least, not without configuring a more complicated VPN setup). When you run ASDM on your computer, ASDM communicates with the FirePOWER module using the real IP address configured on the module, and it does not have the ability to specify a NAT address instead.