topic Re: ASA5506-X, 2 SWITCHES, 4 VLAN in Network Security

ASA5506-X, 2 SWITCHES, 4 VLAN

riccardodem — Fri, 21 Feb 2020 15:49:02 GMT

Hi all, i need to configure a network with 1x ASA5506-X, 2x Cisco small business 48 port switches. I've plan to use 4 different vlan's and connect 2 of the 8 gigabit ethernet of the asa to the switches. How can i configurure asa? Subinterfaces? Bvi? Thanks all

Re: ASA5506-X, 2 SWITCHES, 4 VLAN

Francesco Molino — Sat, 26 May 2018 01:33:04 GMT

First of all you have 2 options:

- all svis for you 4 vlans address hosts on your switches if they have this L3 capability and then have 1 interconnection subnet between switch and asa to route out to Internet.

- all Layer 3 is handled by asa and your switches stay as simple L2 switch.

The 1st option is straight forward where you'll have 1 port for inside interconnection and 1 port for outside connection.

For 2nd option, if you have 4 vlans and want to use only 2 ports, you don't have the choice to go with sub interfaces. If you can have 4 cables then 1 port or vlan.

At this point, if you have 1 interface with 2 sub interfaces, this means you'll 1G shared for these 2 vlans. I believe that enough unless you have specific needs and you'll then prefer going with 1 interface per vlan.

Re: ASA5506-X, 2 SWITCHES, 4 VLAN

riccardodem — Sat, 26 May 2018 07:52:15 GMT

Switch have L3 capabilities, but i want L3 on ASA. 2/3 outside port to isp modem and 2 inside port to internal switch (one per switch).

Static routes for differents private subnet to different outside ports.

My question is: can i have the same vlan on both inside port to switches?

Is a best solution connect only one inside port to asa and swith1 and switch2 toghther?

ASA-->SW1-->SW2

Re: ASA5506-X, 2 SWITCHES, 4 VLAN

Marvin Rhoads — Sat, 26 May 2018 14:24:28 GMT

You could only do same VLAN to both switches if the switches were the type that support stacking or technologies like VSS (Cat 6k, Cat 4k) or VPC (Nexus) - in other words, not generally the small business switches.

You could use an ASA redundant interface to the second switch which would give you some backup in the event that the first switch fails.

Re: ASA5506-X, 2 SWITCHES, 4 VLAN

riccardodem — Sat, 26 May 2018 15:44:05 GMT

Switch are Cisco small business. Solution can be ASA redundancy interface if i can use vlans. Now i've one interface to one switch with subinterfaces, work fine.

Re: ASA5506-X, 2 SWITCHES, 4 VLAN

riccardodem — Wed, 30 May 2018 10:58:07 GMT

ASA redundant interface with subinterfaces was the best solution for me.

thanks all!