LAN Design with ASA 5540
Posted on 2009-02-10
Preparing to re-architect a LAN with 100 users (150 projected).
Currently have an ASA 5540 in place as the firewall, router, web filter, and IPS.
Only the outside and inside interfaces are configured. Inside is connected to an HP switch stack that connects all servers and clients.
Requirements for new architecture:
-Create DMZ to house proxy server and other web servers as company grows.
-Segment all conference room drops to have outside only internet access. No connectivity to servers on LAN.
-Create 2 VLANs. 1 for Servers. 1 for Workstations. Workstations will be DHCP clients on a different subnet than servers which will be statically assigned IPs.
I have a Cisco 3560G-48PS unused, will be purchasing 2 more of the same. Possibly 3.
1. Should the DMZ be created using a separate switch connected to one of the unused interfaces on the ASA?
2. Should the "outside access only" workstations have their own switch connected to an open interface on the ASA, or will VLANing off 10 ports on one of my existing switches be more efficient?
3. For this number of users, would it be recommended to purchase an interior router, or will the ASA be able to handle routing duties sufficiently?
Thank you for any input.