Configuring VLAN Interfaces
For each VLAN to pass traffic, you need to configure an interface name (the nameif command), and for routed mode, an IP address. You should also change the security level from the default, which is 0. If you name an interface "inside" and you do not set the security level explicitly, then the adaptive security appliance sets the security level to 100.
For information about how many VLANs you can configure, see the "Maximum Active VLAN Interfaces for Your License" section on page 4-2.
|
% |
|
|
Note |
If you are using failover, do not use this procedure to name interfaces that you are reserving for failover |
|
communications. See Chapter 14, "Configuring Failover," to configure the failover link. |
|
|
If you change the security level of an interface, and you do not want to wait for existing connections to |
|
|
time out before the new security information is used, you can clear the connections using the |
|
|
clear local-host command. |
|
|
To configure a VLAN interface, perform the following steps: |
|
|
Step 1 |
To specify the VLAN ID, enter the following command: |
|
hostname(config)# interface vlan number |
|
|
Where the number is between 1 and 4090. |
|
|
For example, enter the following command: |
|
|
hostname(config)# interface vlan 100 |
|
|
To remove this VLAN interface and all associated configuration, enter the no interface vlan command. |
|
|
Because this interface also includes the interface name configuration, and the name is used in other |
|
|
commands, those commands are also removed. |
|
|
Step 2 |
(Optional) For the Base license, allow this interface to be the third VLAN by limiting it from initiating |
|
contact to one other VLAN using the following command: |
|
|
hostname(config-if)# no forward interface vlan number |
|
|
Where number specifies the VLAN ID to which this VLAN interface cannot initiate traffic. |
|
|
With the Base license, you can only configure a third VLAN if you use this command to limit it. |
|
|
For example, you have one VLAN assigned to the outside for Internet access, one VLAN assigned to an |
|
|
inside business network, and a third VLAN assigned to your home network. The home network does not |
|
|
need to access the business network, so you can use the no forward interface command on the home |
|
|
VLAN; the business network can access the home network, but the home network cannot access the |
|
|
business network. |
|
|
If you already have two VLAN interfaces configured with a nameif command, be sure to enter the no |
|
|
forward interface command before the nameif command on the third interface; the adaptive security |
|
|
appliance does not allow three fully functioning VLAN interfaces with the Base license on the ASA 5505 |
|
|
adaptive security appliance. |
|
|
X |
|
|
Note If you upgrade to the Security Plus license, you can remove this command and achieve full |
|
|
functionality for this interface. If you leave this command in place, this interface continues to be |
|
|
limited even after upgrading. |
|
|
Step 3 |
To name the interface, enter the following command: |
|
hostname(config-if)# nameif name |
|
|
The name is a text string up to 48 characters, and is not case-sensitive. You can change the name by |
|
|
reentering this command with a new value. Do not enter the no form, because that command causes all |
|
|
commands that refer to that name to be deleted. |
|
|
Step 4 |
To set the security level, enter the following command: |
|
hostname(config-if)# security-level number |
|
Where number is an integer between 0 (lowest) and 100 (highest). |
|
|
Step 5 |
(Routed mode only) To set the IP address, enter one of the following commands. |
|
X |
|
|
Note To set an IPv6 address, see the "Configuring IPv6 on an Interface" section on page 12-3. |
|
|
To set the management IP address for transparent firewall mode, see the "Setting the |
|
|
Management IP Address for a Transparent Firewall" section on page 8-5. In transparent mode, |
|
|
you do not set the IP address for each interface, but rather for the whole adaptive security |
|
|
appliance or context. |
|
|
For failover, you must set the IP address an standby address manually; DHCP and PPPoE are not |
|
|
supported. |
|
|
• To set the IP address manually, enter the following command: |
|
|
hostname(config-if)# ip address ip_address [masi] [standby ip_address] |
|
|
The standby keyword and address is used for failover. See Chapter 14, "Configuring Failover," for |
|
|
more information. |
|
|
• To obtain an IP address from a DHCP server, enter the following command: |
|
|
hostname(config-if)# ip address dhcp [setroute] |
|
|
Reenter this command to reset the DHCP lease and request a new lease. |
|
|
If you do not enable the interface using the no shutdown command before you enter the ip address |
|
|
dhcp command, some DHCP requests might not be sent. |
|
|
• To obtain an IP address from a PPPoE server, see Chapter 35, "Configuring the PPPoE Client." |
|
|
Step 6 |
(Optional) To assign a private MAC address to this interface, enter the following command: |
|
hostname(config-if)# mac-address mac_address [standby mac_address] |
|
|
By default in routed mode, all VLANs use the same MAC address. In transparent mode, the VLANs use |
|
|
unique MAC addresses. You might want to set unique VLANs or change the generated VLANs if your |
|
|
switch requires it, or for access control purposes. |
|
|
Step 7 |
(Optional) To set an interface to management-only mode, so that it does not allow through traffic, enter |
|
the following command: |
|
|
hostname(config-if)# management-only |
|
|
Step 8 |
By default, VLAN interfaces are enabled. To enable the interface, if it is not already enabled, enter the |
|
following command: |
|
|
hostname(config-if)# no shutdown |
|
|
To disable the interface, enter the shutdown command. |
|
|
The following example configures seven VLAN interfaces, including the failover interface which is |
|
|
configured separately using the failover lan command: |
|
|
hostname(config)# interface vlan 100 |
|
|
hostname(config-if)# nameif outside |
|
|
hostname(config-if)# security-level 0 |
|
|
hostname(config-if)# ip address 10.1.1.1 255.255.255.0 |
|
hostname(config- |
if) |
# |
no shutdown |
||||||
|
hostname |
config- |
if) |
# |
interface vlan |
200 |
||||
|
hostname |
config- |
if) |
# |
nameif inside |
|||||
|
hostname |
config- |
if) |
# |
security-level |
100 |
||||
|
hostname |
config- |
if) |
# |
ip address 10.2 |
.1.1 |
255 |
255 |
255 |
0 |
|
hostname |
config- |
if) |
# |
no shutdown |
|||||
|
hostname |
config- |
if) |
# |
interface vlan |
201 |
||||
|
hostname |
config- |
if) |
# |
nameif dept1 |
|||||
|
hostname |
config- |
if) |
# |
security-level |
90 |
||||
|
hostname |
config- |
if) |
# |
ip address 10.2 |
.2.1 |
255 |
255 |
255 |
0 |
|
hostname |
config- |
if) |
# |
no shutdown |
|||||
|
hostname |
config- |
if) |
# |
interface vlan |
202 |
||||
|
hostname |
config- |
if) |
# |
nameif dept2 |
|||||
|
hostname |
config- |
if) |
# |
security-level |
90 |
||||
|
hostname |
config- |
if) |
# |
ip address 10.2 |
.3.1 |
255 |
255 |
255 |
0 |
|
hostname |
config- |
if) |
# |
no shutdown |
|||||
|
hostname |
config- |
if |
)# |
interface vlan 300 |
|
hostname |
config- |
if |
)# |
nameif dmz |
|
hostname |
config- |
if |
)# |
security-level 50 |
|
hostname |
config- |
if |
)# |
ip address 10.3.1.1 255.255.255.0 |
|
hostname |
config- |
if |
)# |
no shutdown |
|
hostname |
config- |
if |
)# |
interface vlan 400 |
|
hostname |
config- |
if |
)# |
nameif backup-isp |
|
hostname |
config- |
if |
)# |
security-level 50 |
|
hostname |
config- |
if |
)# |
ip address 10.1.2.1 255.255.255.0 |
|
hostname |
config- |
if |
)# |
no shutdown |
|
hostname |
config- |
if |
)# |
failover lan faillink vlan500 |
|
hostname |
config) |
# |
failover interface ip faillink 10.4.1 |
|
255.255.255.0
255.255.255.0
The following example configures three VLAN interfaces for the Base license. The third home interface cannot forward traffic to the business interface.
|
hostname |
config- |
if) |
# |
nameif outside |
|
hostname |
config- |
if) |
# |
security-level 0 |
|
hostname |
config- |
if) |
# |
ip address dhcp |
|
hostname |
config- |
if) |
# |
no shutdown |
|
hostname |
config- |
if) |
# |
interface vlan 200 |
|
hostname |
config- |
if) |
# |
nameif business |
|
hostname |
config- |
if) |
# |
security-level 100 |
|
hostname |
config- |
if) |
# |
ip address 10.1.1.1 255.255.255.0 |
|
hostname |
config- |
if) |
# |
no shutdown |
|
hostname |
config- |
if) |
# |
interface vlan 300 |
|
hostname |
config- |
if) |
# |
no forward interface vlan 200 |
|
hostname |
config- |
if) |
# |
nameif home |
|
hostname |
config- |
if) |
# |
security-level 50 |
hostname(config-if)# ip address 10.2.1.1 255.255.255.0
hostname(config-if)# no shutdown hostname(config-if)# ip address 10.2.1.1 255.255.255.0
hostname(config-if)# no shutdown
|
Configuring Switch Ports as Access Ports |
|
|
By default, all switch ports are shut down. To assign a switch port to one VLAN, configure it as an access port. To create a trunk port to carry multiple VLANs, see the "Configuring a Switch Port as a Trunk Port" section on page 4-11. |
|
|
A |
By default, the speed and duplex for switch ports are set to auto-negotiate. The default auto-negotiation setting also includes the Auto-MDI/MDIX feature. Auto-MDI/MDIX eliminates the need for crossover cabling by performing an internal crossover when a straight cable is detected during the auto-negotiation phase. Either the speed or duplex must be set to auto-negotiate to enable Auto-MDI/MDIX for the interface. If you explicitly set both the speed and duplex to a fixed value, thus disabling auto-negotiation for both settings, then Auto-MDI/MDIX is also disabled. |
|
Caution |
The ASA 5505 adaptive security appliance does not support Spanning Tree Protocol for loop detection in the network. Therefore you must ensure that any connection with the adaptive security appliance does not end up in a network loop. |
|
To configure a switch port, perform the following steps: |
|
|
Step 1 |
To specify the switch port you want to configure, enter the following command: hostname(config)# interface ethernet0/port Where port is 0 through 7. For example, enter the following command: hostname(config)# interface ethernet0/1 |
|
Step 2 |
To assign this switch port to a VLAN, enter the following command: hostname(config-if)# switchport access vlan number Where number is the VLAN ID, between 1 and 4090. |
|
X |
|
|
Note |
You might assign multiple switch ports to the primary or backup VLANs if the Internet access device includes Layer 2 redundancy. |
|
Step 3 |
(Optional) To prevent the switch port from communicating with other protected switch ports on the same VLAN, enter the following command: hostname(config-if)# switchport protected You might want to prevent switch ports from communicating with each other if the devices on those switch ports are primarily accessed from other VLANs, you do not need to allow intra-VLAN access, and you want to isolate the devices from each other in case of infection or other security breach. For example, if you have a DMZ that hosts three web servers, you can isolate the web servers from each other if you apply the switchport protected command to each switch port. The inside and outside networks can both communicate with all three web servers, and vice versa, but the web servers cannot communicate with each other. |
|
Step 4 |
(Optional) To set the speed, enter the following command: hostname(config-if)# speed {auto | 10 | 100} |
The auto setting is the default. If you set the speed to anything other than auto on PoE ports Ethernet 0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will not be detected and supplied with power.
Step 5 (Optional) To set the duplex, enter the following command:
hostname(config-if)# duplex {auto | full | half}
The auto setting is the default. If you set the duplex to anything other than auto on PoE ports Ethernet 0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will not be detected and supplied with power.
Step 6 To enable the switch port, if it is not already enabled, enter the following command:
hostname(config-if)# no shutdown
To disable the switch port, enter the shutdown command.
The following example configures five VLAN interfaces, including the failover interface which is configured using the failover lan command:
hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname hostname 255.255.:
hostname hostname hostname hostname hostname hostname hostname hostname hostname config)# interface vlan 100 config-if)# nameif outside config-if)# security-level 0
config-if)# ip address 10.1.1.1 255.255.255.0
config-if)# no shutdown config-if)# interface vlan 200
config-if)# nameif inside config-if)# security-level 100
config-if)# ip address 10.2.1.1 255.255.255.0
config-if)# no shutdown config-if)# interface vlan 300 config-if)# nameif dmz config-if)# security-level 50
config-if)# ip address 10.3.1.1 255.255.255.0
config-if)# no shutdown config-if)# interface vlan 400 config-if)# nameif backup-isp config-if)# security-level 50
config-if)# ip address 10.1.2.1 255.255.255.0
config-if)# no shutdown config-if)# failover lan faillink vlan500
config)# failover interface ip faillink 10.4.1.1 255.255.255.0 standby 10.4.1.2 55.0
config)# interface ethernet 0/0 config-if)# switchport access vlan 100
config-if)# no shutdown config-if)# interface ethernet 0/1 config-if)# switchport access vlan 200
config-if)# no shutdown config-if)# interface ethernet 0/2 config-if)# switchport access vlan 300
config-if)# no shutdown hostname(config-if)# interface ethernet 0/3
hostname(config-if)# switchport access vlan 400
hostname(config-if)# no shutdown hostname(config-if)# hostname(config-if)# hostname(config-if)#
interface ethernet 0/4 switchport access vlan 500 no shutdown
Continue reading here: Configuring and Enabling VLAN Subinterfaces and 8021Q Trunking
Was this article helpful?