ASA vlans on multiple physical interfaces.

Question

I'm confused as to how the asa handles vlans. Currently we're running a 5520 with 4 physical ports.
1 inet 1 backup inet 1 internal 1 dmz

We are in a position where we need to further segment the network. Instead of buying a new asa with more physical ports we're just going to break it out by vlan.

From what I've seen the only way to do this is with sub-interfaces. That works great if all my traffic comes in over 1 physical port but that's not how it will be. We'll have hosts from multiple vlans, connected to 2 different core switches each with an uplink to the asa.

Long story short, if I create vlan 200, 300, 400, and 500 on sub-interfaces under physical interface g0/1 then how do I deal with hosts in those vlans that will come in on say g0/2 ?

Or do I just have to rearrange things physically so this is all aggregated through another switch and it all hits the asa in a single physical uplink.

Hope that makes sense.

Answer 1

The ASA 5520 doesn't have the 'built-in switch' like the ASA 5505 does. To answer your question, you would need to rearrange things...but not necessarily physically. You don't state how the uplink is setup, but if it's switched instead of routed, you should be able to have both core switches reach the ASA without moving cables. Alternatively, or in addition to that, I'd recommend adding a second 5520 and using active/active failover between the two.

On a related side note, you don't typically want WAN/Internet connected directly to the core anyway (following the "modular network design").