VLAN sub-interfaces have most of the capabilities and characteristics of a physical interface, including zone assignability, security services, GroupVPN, DHCP server, IP Helper, routing, and full NAT policy and Access Rule controls. Features excluded from VLAN sub-interfaces at this time are VPN policy binding, WAN dynamic client support, and multicast support. The following table lists the maximum number of sub-interfaces supported on each platform.
| Platform | Number of Sub-Interfaces Supported |
| NSA 3500 | 50 |
| NSA 4500 | 200 |
| NSA E5500 | 256 |
| NSA E6500 | 256 |
| NSA E6500 | 512 |
| NSa 2650 | 256 |
| NSa 3650 | 256 |
| NSa 4650 | 400 |
| NSa 5650 | 500 |
| NSa 6650 | 512 |
| NSa 9250 | 512 |
| NSa 9450 | 512 |
| NSa 9650 | 512 |
Â