Hi,
So it seems you have a Base License ASA5505 unit. This allows 10 unique hosts behind the internal interface.
You can check the licensed limits on your ASA with the following command
show version
From your original post it seems you have the LAN network directly connected to your ASA (meaning that you have no router between the users and the ASA). Considering this you should see all the internal hosts on your network on the ASA with the following command
show arp
This shows the ARP table which includes the IP/MAC pairs of the hosts behind the ASA (that have had any traffic forward to them or from them atleast).
By your above description you already have over 10 devices that you need in your network. I mean for example the 6 PCs and 6 VOIP Phones and if all of these connect to the external network at the same time some of them are bound to get blocked as you are going over the supported 10 user limit.
If there has not been any problems so far with this amount of devices then it almost seems that many of the devices have not been use at the same time or perhaps as you say you have some internal wireless router it might be possible that some devices have been connected to this wireless router and the wireless router has done NAT for these devices behind which would make them visible from single IP address towards the ASA and therefore the ASA would have not reached the 10 client/user limit behind it. Perhaps you have some internal switch that was previously connected to the wireless router and its now connected directly to the ASA or somehow past the wireless router.
So I would suggest that you start by checking how many devices are visible on your ASA at the moment with the "show arp" command. I would then suggest that you check the configurations of the wireless router. Does it have any NAT configuration that would mean if you connected a host behind it that it would be NATed when connection towards the ASA/external network? As I said before, you are already going past the licensed ASA host limit with the PCs/Phones so your quick fix for the situation to my understanding would be to have some device behind the ASA (on the internal network) to perform NAT for the devices so they would be visible from a single IP address to the ASA and therefore not cause the licensed limit to be reached. Perhaps it might be possible to connect the either the PCs or phones behind a device doing NAT? Not really an ideal solution but rather a quick temporary fix.
Hope I made any sense :)
- Jouni
