[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1948
  • Last Modified:

Cisco ASA 5510 Router On A Stick Question

I currently have a Cisco ASA 5510 setup as a Router On A Stick. I do not have the security plus installed on the ASA which would give me the two gigabit ports so I am currently running @ 100mb at the ASA. I have three VLANS setup on Ethernet 0/2 that are then being sent to three Layer 2 (PowerConnect 2748) 1GB cascading switches. My question, with this configuration am I getting a intra vlan bottleneck with the 100mb at the ASA or are my layer2 switches smart enough to make necessary routes between VLANs?

Would getting the ASA5510-SEC-PL license help the speed of my network?
0
jhakie
Asked:
jhakie
  • 5
  • 4
2 Solutions
 
danielc25Commented:
Your layer 2 switches can not route between VLANS. The best case scenario would be to get a L3 switch to handle all of your internal routing so that there is no router on a stick bottleneck. Are the PowerConnect 2748 switches interconnected as well? Some more information on your topology would be helpful.
0
 
jhakieAuthor Commented:
yeah, all the PowerConnect 2748 are interconnected...
0
 
danielc25Commented:
If each of the switches have a link to the ASA then spanning-tree will prefer this as long as the ASA is configured with the lowest spanning-tree priority. Can you verify which path your traffic is taking?
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 
danielc25Commented:
What version of code are you running on the ASA?
0
 
jhakieAuthor Commented:
8.2(4)
0
 
danielc25Commented:
If you want to upgrade to 8.4 you can etherchannel using LACP from the 2748 to the ASA. That would help with your bottleneck.

http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.html#wp432043
0
 
jhakieAuthor Commented:
ok thanks, what exactly does etherchannel using LACP?
0
 
danielc25Commented:
It will allow you to group ports together as one logical link. So you could have 3 links as one 300Mbps link and then interconnect the other switches the same way.

http://www.cisco.com/en/US/tech/tk389/tk213/tsd_technology_support_protocol_home.html

http://en.wikipedia.org/wiki/Link_aggregation
0
 
djcaponeCommented:
Without spending any additional money, danielc suggestion of using LACP to help increase the bandwidth available between your VLANs is something I would agree with.

To go back and answer your original question...If you were to purchase a security plus license, you would then be able to realize the benefit of full GigE connectivity between your VLANs.  Keep in mind that you would still be limited by the single link and as such would be limited to 1 GigE across all links passing traffic between VLANs.  To put this into perspective with an example, lets say you have user 10A and 10B in Vlan 10 and User 20A and 20B in Vlan 20.  If user 10A is transferring a large file to user 20A and user 10B is transferring a large file to 20B, the total bandwidth available to them would 1 Gbps.  As such, even if all from users have GigE uplinks into your 2748 switchs, they would probably see a transfer rate of ~500Mbps each if they were both transferring across VLANs simultaneously.  You can increase this available bandwidth by creating a 2 port LACP etherchannel with the 2 GigE ports offered by the sec plus license and be able to support up to 2 Gbps across VLANs.

The more expensive proposition already proposed by Daniel is to replace your 2748s with Layer 3 switches and then you would realize wire rate speeds for each host as the routing between VLANs would occur locally on the switch.
0
 
jhakieAuthor Commented:
Thank you for helping me out. What I am going to do is purchase the ASA5510-SEC-PL for the time being and over time get layer 3 switches.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now