VLANs on Cisco ASA 5520

[netwalker1]

Dear All :

We are going to implement about 20 VLANs on an ASA 5520 ( Flash : 256 and RAM : 512 ) - using ASA version : 8.0(4)

will there be any performance problem ?

Knowing that the license is supporting up to 150 VLAN ...


Anyone tested something like this can advise ?


Mohamed Farid
[green]Know Me No Pain , No Me Know Pain !!![/green]

 

[unclerico]

is there any reason you can't move the VLAN's to a L3 switch??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[netwalker1]

There is a L3 - and it works with an inter-routing between VLANs already ... but the need is to create access-list between the VLANs , and by revising the needs I found that it will be very hard to create all these access-list rules on the switch !

So we may need to move it the ASA - and this is why I am checking ...

Mohamed Farid
[green]Know Me No Pain , No Me Know Pain !!![/green]

 

[unclerico]

an ACL is an ACL whether it's on a switch, router, or firewall. there's no question that you can do it on the 5520, but your bottleneck is going to be the trunk link between the ASA and the downlevel switch.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[netwalker1]

Yes - you are right ...
However having the Access List on the FW is much easier and efficient than having them on the switch ?

Mohamed Farid
[green]Know Me No Pain , No Me Know Pain !!![/green]

 

[unclerico]

In terms of ease of use, to each his own. In terms of being more efficient, it depends. When ACLs are used in a switch they are actually compiled and executed in hardware just as a router and a firewall (NOTE: This is for most switches and most types of traffic). The limitation is the switch database manager (SDM) that compiles and executes the ACE lookups. It really all comes down to what kind of L3 switches you've got. If you're using a 5520 I'm assuming that you're going to have 4500 or 6500 series switches??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[netwalker1]

4500 Series ...

So - your advise is to create the Access-list on the switches directly ?

Mohamed Farid
[green]Know Me No Pain , No Me Know Pain !!![/green]

 

[unclerico]

The 4500 series supervisors have large TCAM so they can accomodate a large number of ACL's that will be switched in hardware (see the link below if you're interested). In the end, it's all up to you in how you want to do it. Doing it in the switch will remove the single 1GB port as the bottleneck.

http://www.cisco.com/en/US/products/hw/switches/ps663/products_tech_note09186a008054a499.shtml

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)