3

I have a setup like this. (Yes, I suck at Paint)

enter image description here

What I know is:

1) Only the ASA knows sees PCA AND PCB. Because the ASA is the only one who is connected to both VLANS. Am I right?

If I want to Download a File from PCB to PCA. Does the file (10GB big), uses Route1 (the blue one) for the whole 10GB file? OR does the ASA say to the PC something like "Hey the PC is connected to PORT1, you don't have to send the whole package over cable1 and cable2!" and then the File never leaves the Switch and goes over Route2 (the black one)?

I want to know this, because our Server and Clients are on different VLANS. If the file never leaves the Switch, I will put the Clients with the Server they need most often on the some switch.

|improve this question
  • 1
    Just to be perfectly clear, there is no route 2. VLANs 10 and 20 could just as easily be two physical switches. Also, the ASA doesn't know anything about the topology (i.e. PCA is on port 2) – Ricky Beam May 20 '16 at 20:52
3

Hosts on one VLAN cannot communicate with hosts on another VLAN, except through a layer-3 device, e.g. a router.

A VLAN is a layer-2 concept. When hosts communicate, they use layer-2 to communicate on the LAN. VLANs prevent this from happening by dividing the LAN into virtual LANs. A host needing the layer-2 (e.g. MAC) address of the destination will broadcast an ARP request for the destination host's address. A broadcast will only be sent in the LAN or VLAN (broadcast domain). It the destination is on another network, the sending host will use its configured gateway's layer-2 address as the destination layer-2 address.

In your specific case, the switch will keep the traffic in each VLAN separate, and it will only send it directly from one host port to the other if it is a layer-3 switch with routing enabled between the VLANs, and it is configured in the hosts' as the gateway. Otherwise, if the only routing is happening on the ASA, the traffic will need to travel through the ASA.

|improve this answer
  • 2
    Also note that an ASA can be configured either to route traffic between VLANs (interfaces) with the same security level, or to not route traffic (by default) between interfaces with the same security level. In this case that means it's not a given that the ASA will allow traffic between PCA and PCB simply because they are both connected to the ASA. – Todd Wilcox May 20 '16 at 16:22
  • Thanks. @ToddWilcox yeah I know, they will be on the same security level ;-) and i will configure it, that the two vlans are routed. ATRon: Shit, thats not what i hoped. In conclusion, if I use a L2 Switch (SG500X, Catalyst 2960X etc.) the bandwidth of cable 1 &2 will be affacted for other user? – SystemCookie May 20 '16 at 16:30
  • @SystemCookie Yes, if you don't have a layer 3 switch or router-on-a-stick available, and you use the ASA for inter-VLAN routing, then all of your inter-VLAN traffic will share with your Internet and VPN traffic. The upside of inter-VLAN traffic on the ASA is you can leverage ASA rules to block and allow traffic between VLANs based on different criteria. If there are no inter-VLAN security concerns, a layer 3 switch or router-on-a-stick would be more ideal. – Todd Wilcox May 20 '16 at 16:34
  • @SystemCookie, when you say that the bandwidth of one cable will be affected by the other user, you are probably running full duplex, so understand that the bandwidth for incoming and outgoing traffic on the same cable are separate, and one doesn't affect the other. – Ron Maupin♦ May 20 '16 at 16:59
  • Thanks a lot guys. So maybe I will get a L3 Switch for the important File Servers where the most traffic is taking place. Any good L3 switches by cisco? After seeing the price, L2 will do it ;-) – SystemCookie May 20 '16 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.