1

I'm looking to host a few workloads for friends. I have an ASA5510 and a 3500 switch. We plan to have a few VLANs behind the switch, all sharing the single internet connection. I was thinking of trunking a port from the ASA to the 3500, configuring sub-interfaces on the ASA for each VLAN and having the switch point to the ASA for default traffic.

My question is, with regards to the routing side, do I assign an IP to the SVI for each VLAN on the switch (i.e. int VLAN20, ip address 192.168.20.1 255.255.255.0) and have a the next hop pointing to the ASA's sub-interface for that VLAN? I guess that would mean i'd need a default route for each VLAN?

What are the suggestions?

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 14:59

2 Answers 2

Reset to default
4

My question is, with regards to the routing side, do i assign an IP to the SVI for each VLAN on the switch (i.e. int VLAN20, ip address 192.168.20.1 255.255.255.0) and have a the next hop pointing to the ASA's sub-interface for that VLAN? I guess that would mean i'd need a default route for each VLAN?

Since you're building an ASA subinterface (with an IP address), it is more work to add a Layer3 SVI on the 3550. If you have a subinterface on the ASA and an SVI on the 3550, then you need static / dynamic routing between the ASA and 3550. If you do not add an SVI on the 3550, you need no special routing between them.

Trunk all your 3550 vlans as dot1q through (Fa0/1 below) to the ASA interface (Gi0/0 below), and default your users through that ASA's IP address on the appropriate vlan.

                  +---------+ Gi0/0      Fa0/1 +------+
Internet <--------|   ASA   |------------------| 3550 |
                  +---------+       dot1q      +------+
Improve this answer
1

If you're using the 3550 as a pure layer-2 switch, then no, the SVI's don't need addresses. The switch only needs one interface with an address for management. The ASA's interface is the gateway.

If, however, you use the 3550 as a layer-3 switch, each SVI needs an address and that's the gateway address for that VLAN. An additional VLAN is then used for routing to the ASA. No trunking is then required, and inter-vlan traffic isn't bounced through the ASA. The drawback is the ASA cannot inspect the inter-vlan traffic, however it removes the bottleneck of the single link to the ASA. (and internal communication can continue with the ASA down.)

Improve this answer
8
  • Thanks Mike and Ricky - I guess my concern stems around whether the ASA can route same security (inter-VLAN) traffic as i'm told the ASA will try to NAT between the 2 subnets in which case, i'll require additional NAT statements (see this post blog.braini.ac/?p=38). If I was to go down the path of L3 switching, in terms of creating NAT statements on the ASA to provide access to inbound servers (mail, WWW etc;), how will that work between the ASA and the many servers sitting behind each VLAN? Just trying to work out what is less work and most efficient way to make this happen.
    – ik_tech
    Oct 7, 2013 at 22:17
  • The ASA can be setup to allow "same security" traffic, without NAT, but it is more configuration. In the L3 switching model, the ASA only needs static routes for the additional internal VLANs. And you can NAT directly to them. (note: I've done this for "decades" - granted, with a Pix 520)
    – Ricky
    Oct 7, 2013 at 22:23
  • Thanks Ricky - based on this, which would you suggest more ideal for a growing number of VLANs? The L3 switching model or ASA routing?
    – ik_tech
    Oct 7, 2013 at 22:25
  • L3 switch, or if it gets to that point, internal router. (personally, I use an old 1U server running a base debian distro) There are license limits to the number of VLANs on an ASA.
    – Ricky
    Oct 7, 2013 at 22:27
  • Thanks Ricky - just lastly, when you say "The ASA can be setup to allow "same security" traffic, without NAT, but it is more configuration", do you mean as per the blog post i posted?
    – ik_tech
    Oct 7, 2013 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.