For Remote Access (RA) and LAN-to-LAN (L2L) VPN, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX 535s on what is the firewall outside interface before being allowed to pass through to our real internal networks. Both the VPN 3005s and the PIX 535s are being replaced with the ASA-5545X platform. These firewalls are not for our primary Internet traffic, only VPN, and they may also serve as an internal firewalls for traffic going into the data center across private lines.
With the internal firewall ACLs being combined in a single firewall that serves VPN traffic and potentially other private line traffic, for security boundaries and to eliminate any potential routing issues, should the inside interface of the VPN-firewall (5545) stay in a separate subnet from the main Internet firewall or does it really not matter? OSPF is currently running on the Internet firewall (w/default-originate) and the VPN 3005. As this data center is our primary DC for web traffic -- our bread and butter -- I must eliminate any potential issues with the placement of the VPN firewalls that could interfere with this even in the slightest way.
**Should the inside interface of the 5545 land first on the L2 edge switches and then trunk to the agg switches for better security or just have the inside drop straight into the Agg layer, also considering that private line traffic may come through yet another interface on the 5545 in the future.
Only the relevant parts of the L3 connectivity are shown below with the ASA-5545X* that's in question.
Internet | Edge rtr + Edge rtr | 5545* (VPN/Internal fw) + 5540 (Internet fw for traffic in/out DC) | Agg-1 + Agg-2 | etc A pair of L2 switches connect all the edge devices before reaching the Agg switches. Public IP space outside of firewalls, private on inside. (Each firewall is part of a separate failover pair not shown; the 5545 and 5540 have no interaction.)
Looking for answers/comments that could be considered best practice or what you've found works best in a typical enterprise network.