Router on a Stick - Cisco ASA 5510 Security Plus with VLAN Trunk

Curious on some resources and direction on setting up a Cisco ASA5510 to route and provide firewall protection for a trunk of 12 VLAN's. We will have 11 remote offices and small branches connected to the corporate office via direct fiber and line-of-site wireless, and all will be dropped into the corporate office on (1) physical trunk. I would like to plug this in directly to the ASA5510, versus using L3 switches, and would like some resources on setting the routing up correctly.

Thanks!
TercestisiAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
JFrederick29Connect With a Mentor Commented:
Trunk to the ASA and create a subinterface for each VLAN.  Routing will be local between subinterfaces unless each remote office will have a router.  If so, you'll need to add routes to the subnets beyond the remote office router on the ASA.  The remote office clients (if directly connected) will use the appropriate subinterface IP address as their default gateway or if using a router, put a default route on the router pointing to the ASA subinterface.  You'll probably want to set each subinterface to the same security level and enable "same-security-traffic permit inter-interface" so all VLAN's can communicate.  You can restrict access if desired using access-lists on the subinterfaces.  Setup outbound NAT for the remote networks when destined to the Internet and that should be it.
0
 
TercestisiAuthor Commented:
Great, you confirmed what I was thinking other than the same security levels. Many of the VLAN's should not talk to eachother, save for a specific IP address on only (1) other VLAN. Is it best to still keep the security levels the same or to configure them to be different in this scenario?
0
 
JFrederick29Commented:
I would keep them the same.  You can still use access-lists on every subinterface to control access between VLAN's but you don't have to worry about higher/lower security levels.  It simplifies the configuration.
0
 
TercestisiAuthor Commented:
Sounds good; thanks!
0
 
JFrederick29Commented:
No problem, glad to assist.
0
All Courses

From novice to tech pro — start learning today.