Cisco ASA sub-interfaces

[kirkulees007]

Problem: We are getting multiple reports of slowness to our DMZ and from there out to the internet.  I want to make sure that our DMZ is configured per best practice.

Questions:

We have an ASA configured with 5 sub-interfaces on our DMZ segment.  By default the ASA will use the same MAC address for all 5 subnets.  Should we configure a different virtual MAC address for each sub-interface?  Are there any known issues with the sub-interfaces sharing the same MAC address.

Thanks,

[Jennifer Halim]

No, there is no issue with ASA interfaces configured in sub-interfaces.

However, since it's a shared physical interface for 5 networks, I would check that the speed/duplex has been set correctly, and also if there is any errors on the interface.

Typically if the interface is overloaded because it's been shared by 5 different interfaces, slowness might be reported. So it's a good idea to check the interface counter.

I also assume that all the LAN traffic between the sub-interfaces, as well as towards the Inside and Internet from those 5 networks also traverse through the ASA, so if there are lots of those traffic, it might impact on the speed as well.