Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently have two ASA5515-X firewalls, what we want to do is dedicate one of them to providing AnyConnect VPN and two site to site VPNs only, with the second ASA handling firewall ACLs for connecting to our internal VLANs.

We have configured three VLANs on the VPN ASA in preparation for setting up the VPN endpoints. The issue we can't figure out is how to present these three VLANs to the firewall ASA so that we can have specific rules for the three VPN endpoints, we have one subnet per VLAN configured and of course can only have one default route from the VPN ASA to the firewall ASA.

Any suggestions at to how we might implement this would be gratefully received.

share|improve this question

I am slightly mystified as to how the default route might be a constraint here.

I'm gathering that you want traffic to flow through each ASA in series, with one doing VPN termination and the other doing actual firewalling. In this case, there is no reason you can't make the link between the ASAs an 802.1q trunk, and create subinterfaces for each VLAN. You could then apply the appropriate rules to the subinterfaces, and you can specify a route for each of them as well.

Because the three VLANs are logically separate, you need to provide routing for the subnet on each of them individually; you cannot aggregate them in the firewall ASA's routing table. This includes using the default route to route them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.