Cisco ASA sub-interfaces

kirkulees007 — Mon, 11 Mar 2019 20:42:18 GMT

Problem: We are getting multiple reports of slowness to our DMZ and from there out to the internet. I want to make sure that our DMZ is configured per best practice.

Questions:

We have an ASA configured with 5 sub-interfaces on our DMZ segment. By default the ASA will use the same MAC address for all 5 subnets. Should we configure a different virtual MAC address for each sub-interface? Are there any known issues with the sub-interfaces sharing the same MAC address.

Thanks,

Cisco ASA sub-interfaces

Jennifer Halim — Mon, 06 Jun 2011 03:38:35 GMT

No, there is no issue with ASA interfaces configured in sub-interfaces.

However, since it's a shared physical interface for 5 networks, I would check that the speed/duplex has been set correctly, and also if there is any errors on the interface.

Typically if the interface is overloaded because it's been shared by 5 different interfaces, slowness might be reported. So it's a good idea to check the interface counter.

I also assume that all the LAN traffic between the sub-interfaces, as well as towards the Inside and Internet from those 5 networks also traverse through the ASA, so if there are lots of those traffic, it might impact on the speed as well.

topic Cisco ASA sub-interfaces in Network Security

Cisco ASA sub-interfaces

Cisco ASA sub-interfaces