Can one ASA5508x firewall multiple Public IP Addresses?

[VidestraLLC]

I'm working with an installation with a single cable modem and 4 Public IP Addresses. Customer wants to put in a single ASA5508x to act as a firewall to 4 video encoders so that each encoder gets its own IP Address.  We would like each encoder to be accessed on each of the 4 public addresses and port forward (for a little bit more security) to a local address for each encoder. Is this at all feasible with one ASA5508?

To be clear we see it like this...

                               [Public IP1]:42554 to [Private IP1]:554

                               [Public IP2]:42554 to [Private IP2]:554

Cable Modem ->     

                               [Public IP3]:42554 to [Private IP3]:554

                               [Public IP4]:42554 to [Private IP4]:554

We would also like to do IP filtering on the public side to harden the connection.

From what I can tell so far - it looks like we would actually need 4 ASA5508-x to accomplish this...

[Karsten Iwen · Accepted solution]

If the ISP provides four IPs on a single connection, then you can use them on a single ASA. Just think about a customer with a /24 network from the ISP. They don't operate 250 firewalls ... ;-)

You only need NAT as mentioned in your example and some Access-control to restrict who can access the system.

[VidestraLLC]

Doh! Yup - that does explain it clearly and concisely! Thanks!

[Marvin Rhoads]

As long as you have all of the public IPs assigned to you and they're in the same netblock then, yes, you can do that with a single ASA.

[Dennis Mink]

i support customers that have a /24 public range, on the FW the outside interface has 1 public IP out of that range, and the other IP's are just NAT's. this way the FW will pretend it has the full /24. you would need to put a static route to point to your fw outside IP address for the full /24.