Router on a Stick - Cisco ASA 5510 Security Plus with VLAN Trunk

Posted on 2009-04-14
Last Modified: 2012-05-06
Curious on some resources and direction on setting up a Cisco ASA5510 to route and provide firewall protection for a trunk of 12 VLAN's. We will have 11 remote offices and small branches connected to the corporate office via direct fiber and line-of-site wireless, and all will be dropped into the corporate office on (1) physical trunk. I would like to plug this in directly to the ASA5510, versus using L3 switches, and would like some resources on setting the routing up correctly.

Question by:Tercestisi
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 43

Accepted Solution

JFrederick29 earned 500 total points
ID: 24141311
Trunk to the ASA and create a subinterface for each VLAN.  Routing will be local between subinterfaces unless each remote office will have a router.  If so, you'll need to add routes to the subnets beyond the remote office router on the ASA.  The remote office clients (if directly connected) will use the appropriate subinterface IP address as their default gateway or if using a router, put a default route on the router pointing to the ASA subinterface.  You'll probably want to set each subinterface to the same security level and enable "same-security-traffic permit inter-interface" so all VLAN's can communicate.  You can restrict access if desired using access-lists on the subinterfaces.  Setup outbound NAT for the remote networks when destined to the Internet and that should be it.

Author Comment

ID: 24141458
Great, you confirmed what I was thinking other than the same security levels. Many of the VLAN's should not talk to eachother, save for a specific IP address on only (1) other VLAN. Is it best to still keep the security levels the same or to configure them to be different in this scenario?
LVL 43

Expert Comment

ID: 24141536
I would keep them the same.  You can still use access-lists on every subinterface to control access between VLAN's but you don't have to worry about higher/lower security levels.  It simplifies the configuration.

Author Comment

ID: 24141573
Sounds good; thanks!
LVL 43

Expert Comment

ID: 24141581
No problem, glad to assist.

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (…
There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

690 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question