07-30-2015 05:44 AM - edited 03-11-2019 11:21 PM
Hi
I need to incorporate three DMZ networks
on the same switch another 4 server vlans which are fine where they are
I have a 5512 connected to a layer 3 switch via a routed port
how can this be done ?
07-30-2015 06:15 AM
Hi,
I guess one of the typical solutions would be to configure the server port to their own Vlan on the switch and configure a Trunk interface between the switch and the ASA. And in this case there would naturally be no L3 interface for these Vlans on the L3 switch or if there is it would not be the gateway for the actual subnets (gateway on the ASA)
As your current link between the ASA and the L3 switch is a routed link you could either configure a new physical link between the switch and the ASA or modify the current link to a Trunk. If you configured the current link as Trunk then naturally every subnets gateway should be moved to the ASA and the switch would mainly act a normal L2 switch.
Naturally if you want to keep the switch L3 for all the subnets and still route the traffic through the ASA then you could check if the switch supports VRF Lite (or whatever the official term is) and
Using the VRFs would separate the routing of the subnets configured under the Vlan interfaces and you could route all traffic through the ASA. The link between the ASA could be Trunk in this case. Naturally if there is need you could use a couple of physical interfaces on ASA/Switch and configure a Port-channel between the ASA and the L3 switch if you feel that one 1Gbps link is not enough. Though I guess the ASA models throughput was pretty close to 1Gbps anyway.
- Jouni
07-30-2015 06:40 AM
thanks
could I create seperate vlans for DMZ
create seperate subnet for dmz related traffic
secure traffic between dmz network and managment network using ACL's on the switch
I have seen VRF lite
how would the config look like if I decided with your last option . I have 3850 for L3
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide