Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco ASA 5520 that I recently acquired from work that I am planning to use as my home router. I also have a Linksys E4200 router and a Linksys WRT610N router, both dual-band, that I would be turning into access points. I also have a 3rd 5Ghz-only N access point lying around.

I am planning on dividing my home network/home lab into Vlans/subnets like so:

  • Vlan 10 - DMZ zone
    • wireless clients, iPads
  • Vlan 20 - Servers
    • NAS devices, ESX servers, security systems
  • Vlan 100 - Management zone
    • management IPs for Cisco switches, ASA, etc.

My current plan is to have GigabitEthernet0/0 on the ASA connect to my Internet connection and grab an address via DHCP. All the rest of the ports will connect to a Cisco Catalyst 2960G switch where I will configure all of the VLANs for each port.

My main concern is having things like Vonage (SIP), FaceTime (on iPhones and iPads), and other media-related things such as TiVo/Bluray Player/gaming systems/etc able to open ports as needed via UPnP. As a result, my first idea was to have all incoming traffic by default sent to a Linksys Router which handles DHCP/UPnP/etc for Vlan 10. Most devices would connect to that in order to get out to the Internet, while at the same time having to pass traffic through the ASA for access to more "privileged" resources.

Is this possible? Do I need to setup a mixed-context (transparent/routing) environment in order to accomplish this?

share|improve this question

migrated from Apr 16 '13 at 2:19

This question came from our site for system and network administrators.

You have a 5520 at home... can.. can.. can I have it? Prettyyy please? – Mark Henderson Apr 16 '13 at 6:04
I have to ask - You want to use a enterprise firewall that can easily net you at least $2k on ebay as a firewall in your home? Why not just sell it and buy new stuff that works great with the services you listed (like an airport extreme), and have $1700 left for beer? – pauska Apr 16 '13 at 6:04
NAT sucks. Yell at your ISP until they give you IPv6. – Michael Hampton Apr 16 '13 at 6:21
@MichaelHampton and then yell at every service provider in the world to add IPv6 connectivity... you're going to be yelling a lot... – Mark Henderson Apr 16 '13 at 6:25
@MarkHenderson I can use Google and Facebook on IPv6...what more do you need? – Michael Hampton Apr 16 '13 at 6:30

You must log in to answer this question.

Browse other questions tagged .