I currently manage 6 Cisco ASA devices (2 pairs of 5510s and 1 pair of 5550s). They all work quite nicely and are stable so this is more of a best-practice advice question rather then "OMG it's broken help me fix it".
My network is split into multiple VLANs. Pretty much each service role has its own VLAN so DB servers would have their own VLAN, APP servers, Cassandra nodes.
Traffic is being managed on an allow only specific, deny rest basics (so default policy is to drop all traffic). I do this by creating two ACLs per network interface, eg.:
- access-list dc2-850-db-in ACL that's being applied to dc2-850-db interface in "in" direction
- access-list dc2-850-db-out ACL that's being applied to dc2-850-db interface in "out" direction
It's all pretty tight and works as expected, however I was wondering whether this is the best possible way to go? At the moment I got to a point where I have over 30 VLANs and I must say it's becoming slightly confusing at some points to manage those.
Probably something like common/shared ACLs would help here which I could inherit from other ACLs but AFAIK there's no such thing...
Any advice much appreciated.