Cisco ASA 5506-X with a single server

[emilyforcisco1]

The old ASA 5505 had a built-in switch, but that's not the case with the 5506-X. I'm wanting to stick a firewall and single VMware server at a data center for some DR failover needs. I think if I only connect one NIC of the VMware server this should work, but if I need more than one NIC (like the iDRAC), then I'm either going to need a small switch, or I'll have to put the iDRAC on a different VLAN. Should this work (putting the iDRAC on a different VLAN), or am I going to need a switch to make this work?

[mattjones03]

Hi,

You are likely to require to place the DRAC interface onto a dedicated interface, as this is delivered directly from the server chassis, and not part of the VMware hypervisor delivery.

In this instance, I would suggest that you purchase a small switch for this that is 802.1q aware.

The Cisco Small Business (SG) range of switches would suffice.

[mattjones03]

Dennis, has a point. The ASA 5506 does have 8 x 1 Gigabit Ethernet (GE).

Cisco ASA 5506 (Data Sheet)
http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

With this in mind, you will be able to proceed without purchasing an additional switch, and deliver the solution you intend with the hardware you already have.

[Karsten Iwen]

The new software that gives the 5506 a switching mode is not yet available. At the moment all interfaces are routed interfaces and there are no vlan-interfaces as on the 5505.

[Dennis Mink]

As always, it depends

But these 5506 have multiple Ge ports (8 of the top of my head),

so for instance, If you needed 2 devices in your internal or DMZ (vmware and IDRAC),

you could plug these 2 into the 5506 and assigning to vlan 100 for instance, the interface vlan 100 on that same ASA could be your named inside or DMZ interface, and all security would be applied to that vlan interface not the physical interface.

so I would think you dont need an additional switch

cheers

[Karsten Iwen]

Another way to solve the problem: If this is a really limited scenario, you could configure the ASA as transparent firewall. There you can have all interfaces in one IP-subnet but still have full control for the communication between all interfaces.