What kind of cisco firewall should I choose?

Depends on what you mean by "small". The PIX 501 cannot handle VLANs at all, the PIX 506/506E can handle only 2 VLANs, and the 515/515E and 525 cannot handle more than a dozen VLANs in PIX 6.x (but can handle noticably more VLANs if you use PIX 7.0 for them.)

The 5510 is pretty small too. Perhaps you should give us some numbers -- number of VLANs you need, throughput you need, number of physical interfaces, total number of simultaneous VPN connections, nature of those connections (LAN to LAN or PC to LAN), encryption standards you require, VPN types required (IPSec, PPTP, L2TP). Also, is it acceptable for the VPN termination address at your end to be the same for all the customers, with the destination determined by the group name and password they log in with (PC to LAN) or by their source address (LAN to LAN) ? If you need distinct VPN termination addresses for each client, then it could be a bit of a challenge, that might be solvable if you have a WAN router that is able to route into different VLANs.

Hi Walter,

Thank you for your reply. It is just a testing firewall and I only need 10 VLAN's and 10 VPN's. Later I need a asa 5540.

But I have to make this firewall work with this funktionality. Are thire guides on the net about this setup?

All the VPN's has to be terminated into a VLAN. All the VLAN are connected to a switch with ONE cable... Is this posible?

/C

If they have servers inside (linux, ISA, Win2k, etc.), you can already use them as VPN terminators. Just another option for consideration.

Cen

ASA-5510 does not support VLANs nor security contexts. At ASA-5520 and above both VLANs and contexts are supported.

ASA models comparison:

The ASA 5510 Security Plus supports 10 VLANs or am I missing something?

/C