Since ASA will be the L3 hop, you would need to create ASA physical interface in the same VLAN as the users VLAN. Just connect the ASA inside interface to the switch port and assign the switch port the same VLAN as the user VLAN. All users and ASA inside interface will then be in the same VLAN and subnet, and ASA will be the default gateway for your users.
The ASA needs sub-interfaces for the clan command).
But as already suggested if you put 10 users and the ASA interfaces on the same vlans on the switch then the ASA will see all the user traffic. So having all ports of the users and the ASA's inside are access ports for vlan x on the switch then it will work.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...