Multiple security zones on same etherchannel ASA5525-X

[network1215]

Hi All,

I am trying to figure out if we can multiple security zones on same etherchannel.

For example: inside & DMZ

We have 8 ports on the ASA(standalone) and was thinking to create either one of following.

1-  create 2 ports etherchannel for Inside zone and 2 port etherchannel for DMZ, keeping inside zone and DMZ separate.

      I will have to create multiple subinterfaces for multiple vlans such as user,voip,server.

      example for INSIDE port channel:    

      Interface Port-channel 1.1

      vlan 10

      nameif user

      security-level 100

      ip address x.x.x.x x.x.x.x.x

     Interface Port-channel 1.2

      vlan 20

      nameif Server

      security-level 100

      ip address x.x.x.x x.x.x.x.x

Similarly for port-channel 2 (DMZ) I will have to create multiple subinterfaces for multiple vlans such as DMZ, wireless etc

Interface Port-channel 2.1

      vlan 30

      nameif DMZ

      security-level 50

      ip address x.x.x.x x.x.x.x.x

Interface Port-channel 2.2

      vlan 40

      nameif wireless

      security-level 100

      ip address x.x.x.x x.x.x.x.x

2 - I can bundle up 4 physical ports into one port-channel and combine INSIDE and DMZ all in same port channel.

     Example:

Interface Port-channel 1.1

      vlan 10

      nameif user

      security-level 100

      ip address x.x.x.x x.x.x.x.x

Interface Port-channel 1.2

      vlan 30

      nameif DMZ

      security-level 50

      ip address x.x.x.x x.x.x.x.x

is it a best practice or should I keep the Zones in separate port-channels ? or keeping all in one port-channel ? any security concerns ?

Also we will be connecting additional firewall later infront of ASA 5525-X and that additional firewall will only be used for S2S VPN connections. 

[Francesco Molino · Accepted solution]

Hi

Both are ok.
The real question is: do all dmz and users vlans are located on the same switch? And do you want to avoid any traffic issue to impact each others (congestion, l2 storm on your vlans....)

I personally prefer separating dmz vs campus user and would go with option 1.
However if you want to have a big PO to increase the max bandwidth, option 2 is better but if congestion happens, it could impact all vlans going through this PO.

[network1215]

Good Point Francesco. 

do all dmz and users vlans are located on the same switch?   Yes, there is down stream stack of 2 member switches, All VLANs will reside on it.

However if you want to have a big PO to increase the max bandwidth ? My understanding is even if bundle four physical ports in one etherchannel, I think (or maybe mistaken) the throughput will remain 2Gbps as a limitation on ASA5525-X ?

[Francesco Molino]

Sure the limitation of asa 5525 will still be the same even if you put multiple 1G traffic. I was saying this for all situation (device agnostic).

On vlans are on the same stack which means you can go with both options. As I said before, i prefer option 1 to limit impacts and future needs.

[network1215]

Great.. Much appreciated for your prompt responses.

[Francesco Molino]

You're welcome