What Device/System to use as a “router on a stick”

routingvlan

I need to create several distinct VLANs, and provide a way for traffic to move between them. A "router on a stick" approach seems ideal:


                                Internet
                                   |
                      Router with Trunking Capability ("router on a stick")
                                   *
                                   *  Trunk between router and switch
                                   *
                      Switch with Trunking Capability
                       |      |       |      |      |
                       |      |       |      |      |
                       |    LAN 2     |    LAN 4    |
                       | 10.0.2.0/24  | 10.0.4.0/24 |
                       |              |             |
                     LAN 1          LAN 3         LAN 5
                  10.0.1.0/24    10.0.3.0/24   10.0.5.0/24

We have trunk-capable Layer-2 switches. The question is what to use as the router on a stick. My choices seem to be:

  1. Use an existing Cisco 5505 ASA firewall. It appears the ASA can do the routing, but it's a 100Mbps device, and so seems sub-optimal at best
  2. Buy a router. This seems overkill.
  3. Buy a Layer-3 switch. Also seems overkill.
  4. Use an existing, shared Linux Box as a router (e.g. the NIS server)
  5. Use a dedicated Linux box as a router
  6. Something I'm not thinking of

I think either (4) or (5) is my best option, but I'm not sure how to choose between them. I expect the amount of traffic that has to cross the VLANs to be somewhat small, but bursty. How much load does routing add to a CentOS machine?

Best Answer

Option 1 is good as:

  1. ASA hardware is very reliable and if you have add-on module like CSC then you get anti-virus protection between LANs (For HTTP/FTP/SMTP/POP3 Only).
  2. If you are using ASA you reduce points of failure and you would already be familiar with ASA firewall syntax.

Option 2 and 3 are not desirable due to cost over head.

Option 4 and 5 both are ok. If your NIS server remains up most of the time and does not require tinkering. If you use NIS server for interVLAN routing then whenever you reboot server for maintenance, network will stop working. If NIS server is not reliable or requires frequent reboots then dedicated server is better. Again depends on how much cost of one additional server matters.

Option 4 and 5 will allow you to put basic firewall rules in iptables if you want to allow only certain type of interVLAN traffic. You can also capture packets using tcpdump/wireshark and analyze in case of problems. Having a Linux machine as main router would be heaven for people who want to learn network diagnostics by capturing and analysing packets. You can also run DHCP server on this machine, since you do not have Layer 3 switch you cannot specify 'ip helper-address', so this is the only way to have centralized DHCP server without having a L3 switch.

Related Topic