Cisco ASA Network Design Question

Is there a specific reason you are using the ASA for inter-vlan traffic?

I would let the 3850 be your site router and send all external bound traffic (e.g. Internet) to the ASA.

Having all inter-vlan traffic go up to the ASA and then come back down is inefficient and the ASA is not adding any value here. The 3850, however, is well suited for the job, and it can handle all the inter-vlan routing.

The 3850 can also handle any necessary ACLs for controlling traffic between VLANs.

The reason I use  ASA for inter-vlan routing is because all traffic between different vlans has to traverse the firewall which also provides service of IPS which can detect any malicious code in my internal network it will also prevent spreading of malicious code between different vlans.

Fair enough. However, I think that's over kill. This will put a lot of pressure on the ASA and will lower throughput and performance. You also have to be careful with IPS. There will be many false positives and there will be a tax on performance.

You can still control any malicious activity by using ACLs to control traffic between VLANs, if necessary, and other client-side software for detection (Sophos, Karspesky, etc.). Also, having servers, clients, and other devices in different VLANs will limit broadcast aspects of any malicious activity.

You could segregate part of the traffic (e.g. database servers) and have them pass thru the ASA, but I wouldn't have all traffic pass thru.

Ok so basically I will put most critical servers behind ASA.

How much bandwidth does average network user actually need?