Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to make a simple network architecture for a small company.

One of the sites is built of a firewall (to create a DMZ, to make the VPN between the sites) and three switches, like in link below.

enter image description here

There are workstations connected to each of the switches. It is a VLAN-based network. Employees obtain their addresses with DHCP server. The company has got also another site, connected with a VPN/IPSec tunnel.

My question is, would it be reasonable to use a layer 3 Switch as SW3? I would then configure the DHCP server and routing inside the site on SW3, leaving ASA for things related with DMZ and VPN.

Or do you think using a layer 2 switch will be enough as SW3, and make all the routing and DHCP configurations on ASA?

Thank you for every answer. I am just afraid it is not worth it doing it with layer 3 switch and a firewall. If you know some literature about creating an architecture I would appreciate.

share|improve this question
up vote 1 down vote accepted

List pros and cons for both scenarios and decide. Only you can know which option is best as you know what your environment requirements are. I will start :

With Layer 3 switch

  • Less load on the ASA
  • ASA only deals with external traffic
  • all LAN subnets are contained withing the switches.

Without Layer 3 switch

  • No need to buy layer 3 switch
  • All of the internal network is exposed to ASA
  • You can filter internal traffic using ASA if needed.


share|improve this answer
Yes, this is in general the thing I am considering, that there are pros for both approaches. I only was not sure if in general it is worth being considered. Thank you for ensuring! – Justine Nov 9 '11 at 14:10
If you have heavy inter-vLAN traffic you should more heavily consider the L3 Switch design as the ASA will quickly become a bottleneck. If this is not the case without the L3 Switch would be simpler and cheaper. – Chris S Nov 10 '11 at 13:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.