Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to create several distinct VLANs, and provide a way for traffic to move between them. A "router on a stick" approach seems ideal:

                      Router with Trunking Capability ("router on a stick")
                                   *  Trunk between router and switch
                      Switch with Trunking Capability
                       |      |       |      |      |
                       |      |       |      |      |
                       |    LAN 2     |    LAN 4    |
                       |  | |
                       |              |             |
                     LAN 1          LAN 3         LAN 5

We have trunk-capable Layer-2 switches. The question is what to use as the router on a stick. My choices seem to be:

  1. Use an existing Cisco 5505 ASA firewall. It appears the ASA can do the routing, but it's a 100Mbps device, and so seems sub-optimal at best
  2. Buy a router. This seems overkill.
  3. Buy a Layer-3 switch. Also seems overkill.
  4. Use an existing, shared Linux Box as a router (e.g. the NIS server)
  5. Use a dedicated Linux box as a router
  6. Something I'm not thinking of

I think either (4) or (5) is my best option, but I'm not sure how to choose between them. I expect the amount of traffic that has to cross the VLANs to be somewhat small, but bursty. How much load does routing add to a CentOS machine?

share|improve this question
I'm missing something .. shouldn't the switch manage the routing between the VLANs? And if so, the ASA 5505 100MBps shouldn't be an issue. – tomjedrz Jun 7 '10 at 5:53
The switch is only a regular layer 2 switch. It can't do any routing between the vlans. In the diagram, the "router on a stick" or in this case the ASA, would do the routing for the network. – okonomiyaki Jun 7 '10 at 6:14
up vote 1 down vote accepted

Option 1 is good as:

  1. ASA hardware is very reliable and if you have add-on module like CSC then you get anti-virus protection between LANs (For HTTP/FTP/SMTP/POP3 Only).
  2. If you are using ASA you reduce points of failure and you would already be familiar with ASA firewall syntax.

Option 2 and 3 are not desirable due to cost over head.

Option 4 and 5 both are ok. If your NIS server remains up most of the time and does not require tinkering. If you use NIS server for interVLAN routing then whenever you reboot server for maintenance, network will stop working. If NIS server is not reliable or requires frequent reboots then dedicated server is better. Again depends on how much cost of one additional server matters.

Option 4 and 5 will allow you to put basic firewall rules in iptables if you want to allow only certain type of interVLAN traffic. You can also capture packets using tcpdump/wireshark and analyze in case of problems. Having a Linux machine as main router would be heaven for people who want to learn network diagnostics by capturing and analysing packets. You can also run DHCP server on this machine, since you do not have Layer 3 switch you cannot specify 'ip helper-address', so this is the only way to have centralized DHCP server without having a L3 switch.

share|improve this answer
Centralized DHCP is desired, and I didn't realize I needed a Layer 3 switch to do that. Linux server it is -- and thanks! – Jeff Leyser Jun 7 '10 at 13:45
@Jeff Leyser: I'm unsure what the poster means re: needing a layer 3 switch to centralize DHCP. All you need is a DHCP relay in each subnet where a DHCP server is not located. Many routers and layer 3 switches have DHCP relay functionality built-in (in Cisco parlance an "ip helper"). You can run a DHCP relay on any host in the broadcast domain w/ the DHCP clients.… – Evan Anderson Jun 9 '10 at 22:26
But if I want exactly one DHCP server, doesn't that need to be the same device as the Router on a Stick. That's what I took him to mean -- I'd need L3 switching to route the broadcasts to the right device, if it wasn't the router itself. – Jeff Leyser Jun 10 '10 at 0:08

I would suggest either 1 or 5, with 1 being preferred. The Cisco ASA even with the 100Mbps interface should be able to handle routing between your vlans. If you don't expect lots of traffic across vlans, then why do you feel it won't be able to handle this load? Is the current cpu/mem usage on the ASA that high? What type of Internet connection do you have?

The reason why I would suggest using your existing ASA: 1. Don't need to purchase new hardware, or redeploy current hardware. 2. Reduces the number of potential points of failure. Yes, now everything relies on the ASA but that is preferred over having to worry about the ASA and a dedicated linux server acting as a router. You could just purchase another ASA in the future and setup HA.

share|improve this answer

I'd use a dedicated device-- either a layer 3 switch, router, or dedicated commodity PC.

The nicest thing about using a dedicated device is that you don't lose your intra-VLAN routing because of regular maintenance events like server computer patches / reboots. A sufficiently stripped-down Linux or OpenBSD installation running no unnecessary services will need very little in the way of regular patching and rebooting (not unlike most purpose-built embedded devices), and you can use less volatile storage technologies than hard disk drives, like boot from flash or optical media.

Rather than relying on any off-the-shelf benchmarks I'd do some in-house testing with the types and quantities of traffic that you expect to be moving around. Particularly on a shared server / router scenario, the character of your particular server computer's existing workload and NIC drivers are going to play a big role in performance.

My prior experience suggests that you wouldn't expect to see a noticible hit in performance for a lightly-loaded server computer's other duties if it were processing small, bursty routing traffic. YMMV, though, and you should test it out and see.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.