Until now I have been involved in using Cisco hardware in professional environment but on a small level. Recently, requirement has came up for our new facility to be built with PCI compliance in mind and since we have quite a lot of traffic passing between the servers we have decided to invest some money into high-end Cisco hardware (at least high-end with what I have been using so far - Cisco 5505 / Cisco 5510s).
- 2* Cisco ASA 5550
- 4* Cisco Catalyst 2960G-48TC
There will be two racks, in each 1 ASA and 2 switches. I have been thinking for a while on the best way to cross connect everything and came out with following schema:
- so 2 ASA working in HA mode, Active/Standby (we can't use Active/Active as we have a lot of VPN sessions)
- ASAs are connected with each other using two links 0/3 - 0/3 as FOLINK and 1/3 - 1/3 as STATELINK
- 0/0s in ASAs are feeds from our ISP
- ASAs are connected with each switch in local rack using LACP bundles (two cables each)
- switches are also connected with each other using LACP bundles
Now a request for advice here - is there anything wrong in my thinking as for this design? Could anything be improved / changed to make it better?
All advice, much appreciated!