Of course you can. Having said that, numbers do matter. How many total endpoints do you project you’ll have in the deployment and what do you anticipate the peak concurrent session count to be? Will there be a lot of guest and byod as well? ... View more

What is not working exactly? Some issues I see: access-list out-in extended permit icmp any any echo-reply access-list out-in extended deny ip any any access-list out_in extended permit tcp any host 192.168.1.20 eq 7778 What do you expect the first line of that access list will do? In the current configuration, it does nothing. Also, the 3rd line of the access list will never be reached because the line above it denies all ip traffic. It looks like you want to be able to reach tcp port 7778 on 192.168.1.20 from the Internet, however, you don’t have a static PAT (NAT) entry exposing the port/address to the internet. I also see you have a dynamic NAT for “any” to outside, but then you have other more specific dynamic NAT entries. I’d have to double check, but I don’t think that’s necessary. George ... View more

Please share the relevant configuration. You have to make sure you have local authentication as an allowed method if you want local authentication to be allowed. George ... View more

Double NAT shouldn’t be a problem if I understand your scenario. How do you know the traffic is arriving at the ASA? What does your ASA NAT configuration look like? ... View more