Steven
Now from a best practices and design standpoint, you should be running all inter-vlan traffic through the ASA for the best security practices, and in this case you would create a trunk from 3560 to ASA and create sub interfaces on the ASA.
Do you mean for this specific setup or as a more general point ?
If your security requirements are that you must firewall between internal vlans then yes i agree with what you say but for a lot of companies there is no real need for this.
The main issue with using the ASA for routing between internal vlans is that it can become a bottleneck compared with L3 switches. Not only that, it significantly complicates the configuration because the ASA is not really a router as such.
In addition if that was best practice there would be little need for L3 switches if you were routing everything off the firewall.
In a large office or campus environment, unless you have very strict security requirements, there is rarely a need to firewall between client vlans and it would impractical to do so.
For smaller environments where you don't have a L3 switch and only a few vlans it can be a valid choice.
Finally, as with a lot of other things, the rules for a DC are different and here it may well be desirable to firewall between vlans so yes it could well make sense in that environment.
Just my opinion though, so not saying i am necessarily right.
Jon
