|
Question : Cisco ASA/3750 Multiple VLAN setup
|
|
Ok, here is my situation. I am getting ready to purchase (2) Cisco 3750-24TS-S switches and use the stackwise cable for interconnect. These switches will be used as my vlan/routing switches. I want to have the following vlans configured on the switch:
1 - Outside Vlan (VLAN for outside public access) 2 - DMZ Vlan (For servers that are public facing EX:Public DNS Servers, Video Camera Servers, Vendor Inventory Servers) 3 - Server Vlan (For internal servers for the company) 4 - IT VLan 5 - Call Center Vlan 6 - Accouting Vlan 7 - Production Vlan 8 - Warehouse Vlan 9 - Catalog Vlan
We have two T1's that come in and are bonded into a single MLPPP Channel giving us 3Mbps bandwidth. We use the Cisco 2821 Router for the DSU/CSU termination point for the T1's. The Ethernet interface off of the Router will plug into the Outside Vlan and have an IP address of 206.132.X.X /27. The next device to plug into the Outside VLan is the Cisco ASA 5510. It also has an public facing IP address in the 206.132.X.X /27 range. The next Ethernet Interface on the ASA will plug into the DMZ Vlan and have an IP address of 172.16.X.1 /24. The DNS Servers etc., will also plug into that same vlan and use 172.16.X.1 /24 on the ASA interface as their default gateway. I then take the third ASA interface and plug it into the Server Vlan with the third Ethernet Interface IP address as 10.1.X.1 /24. I then plug our internal company servers as well into that Server Vlan. Here is when I get a little confused. I want another firewall interface barrier to sit in between the internal servers and the rest of the companies vlans. The only thing is, is that IT & Production need access to the file servers on the Server Vlan without going through the ASA. The rest of company however I want to have them go through another ASA interface to get to the Servers on the Server Vlan. This would create some internal security as well since I now have a firewall between the inside company and the inside internal servers. Does this sound like a smart thing to do? And more specifically how would I go about accomplishing this setup.
|
Answer : Cisco ASA/3750 Multiple VLAN setup
|
|
>do need an IP address assigned to the vlan that the inside interface of the ASA will be connecting to? Why? Not if your inside interface is in one of the other vlans. If you use my example of a separate vlan just for the purpose of isolating the inside interface, then yes you would assign the switch vlan interface an IP address in the same subnet as the ASA interface, which is a different subnet than all the rest of the vlans/subnets. The 3750 handles all the routing. Why? To segregate the ASA interface into a separate "private" vlan that does not see all the broadcasts from the others. If it's in another vlan, then something has to route the other traffic to it - a vlan interface on the 3750.
|
|
|
|