I'm confused as to how the asa handles vlans. Currently we're running a 5520 with 4 physical ports.
1 inet 1 backup inet 1 internal 1 dmz

We are in a position where we need to further segment the network. Instead of buying a new asa with more physical ports we're just going to break it out by vlan.

From what I've seen the only way to do this is with sub-interfaces. That works great if all my traffic comes in over 1 physical port but that's not how it will be. We'll have hosts from multiple vlans, connected to 2 different core switches each with an uplink to the asa.

Long story short, if I create vlan 200, 300, 400, and 500 on sub-interfaces under physical interface g0/1 then how do I deal with hosts in those vlans that will come in on say g0/2 ?

Or do I just have to rearrange things physically so this is all aggregated through another switch and it all hits the asa in a single physical uplink.

Hope that makes sense.

1 Answer 1


The ASA 5520 doesn't have the 'built-in switch' like the ASA 5505 does. To answer your question, you would need to rearrange things...but not necessarily physically. You don't state how the uplink is setup, but if it's switched instead of routed, you should be able to have both core switches reach the ASA without moving cables. Alternatively, or in addition to that, I'd recommend adding a second 5520 and using active/active failover between the two.

On a related side note, you don't typically want WAN/Internet connected directly to the core anyway (following the "modular network design").

  • Ok thanks. I'd attempt to explain the layout but its a mess, its my third month here and we're trying to clean things up. Another ASA is planned for redundancy just not right now. At least now I know that I just need to get everything in on a single port and all will be good. Thanks.
    – TheEditor
    Commented Mar 10, 2014 at 18:15
  • Normally you'd plug WAN/Internet into an Edge router (border router) to route between the backbone, LANs, and WAN.
    – HAL
    Commented Mar 10, 2014 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.