I am having a challenge that I am not sure the best way to solve:
I am replacing an aging PIX with a new ASA 5510. One thing I want to take advantage of is that the ASA supports virtual interfaces, which I would like to use to channel guest traffic on a wireless lan that I am setting up right now. The problem is I inherited a rather convoluted environment, which I am loathe to change at this point.
Here is the problem:
The PIX has an IP address of 10.10.0.253 255.255.0.0. It is directly plugged into a switch with trunking enabled. For what ever reason that switch has a IP of 10.10.11.7 255.255.0.0. This switch has no VLANs defined. This switch is part of a group of switches that manage the connections in our server room. One of those switches has the IP address of 10.10.0.1 255.255.0.0 and acts as the default gateway for the entire network. The PIX is not plugged into that switch.
We have a distribution switch which distributes 5 main VLANs to the 5 floors we use in the building. Its IP is 10.16.0.1 255.255.255.0. The VLAN model looks like this 10.16.0.1 for the 6th floor 10.17.0.1 for the 7th etc. There are guest vlans on each floor. 10.16.3.0 10.17.3.0 etc (for example). We call them VLAN 63, VLAN 73 etc.
On the new ASA I want the inside interface e0/0 to have in addition to the main network traffic VLAN 63, 73 etc. on virtual interfaces. So that switch would look something like this:
(Inside) E0/0 - 10.10.0.253 (VLAN63) E0/0.1 - 10.16.3.253. etc.
Here is the rub. It looks just plain trunking will not deliver the guest VLAN traffic to the ASA virtual interfaces. I think the ASA needs to be directly attached to the switch that has the VLANs attached, or I need to do some fancy stuff to make it work.
Diagram:
PIX Switch Dist. Switch VLAN63
[========]____________[===
10.10.0.253 10.10.11.7 10.16.0.1 VLAN73
I am not sure whether it make sense to plug the ASA into the "distribution" switch to make this happen, and if so what the various routing configurations would be, or if would even work at all.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Quori,
This is how I was thinking. There doesn't seem to be good reason to extend it to the middle switch. The only reason for keeping it like it is now, if to keep it like it is now. I am just a little nervous about doing it as the only way I have to test it fully is in production. I will accept your answer as the solution and award you the points.
Thanks much!
Not sure what you mean remove everything from it.
This is my config for the "inside" interface:
interface Ethernet0/0
speed 100
duplex full
no nameif
no security-level
no ip address
!
interface Ethernet0/0.1
speed 100
duplex full
vlan 1
nameif Inside
security-level 100
ip address 10.10.0.253 255.255.0.0 standby 10.10.0.2
!
interface Ethernet0/0.2
vlan 63
nameif Guest63
security-level 50
ip address 10.16.3.0 255.255.255.0
!
interface Ethernet0/0.2
vlan 103
nameif Guest103
security-level 50
ip address 10.20.3.0 255.255.255.0
Theoretically it might work, honestly I've never tried.
Create 0.1 subif and don't append a vlan statement. All untagged traffic should hit it and tagged should hit anything with a tag.
Another option would be to change the native VLAN of the dot1q trunk to some unused VLAN, that way VLAN1 should get tagged then just add 'vlan 1' under the subif.
The ASA is 10.10.0.253. VLAN1 = 10.10.0.0 is directly connected.
Here is my routing on the switch:
6-SRV-3750DIST-STACK2#show
Gateway of last resort is 10.10.0.253 to network 0.0.0.0
10.0.0.0/8 is variably subnetted, 20 subnets, 2 masks
C 10.10.0.0/16 is directly connected, Vlan1
C 10.19.9.0/24 is directly connected, Vlan91
C 10.18.9.0/24 is directly connected, Vlan81
C 10.17.9.0/24 is directly connected, Vlan71
C 10.16.9.0/24 is directly connected, Vlan61
R 10.30.0.0/16 [120/2] via 10.10.11.30, 00:00:18, Vlan1
C 10.20.9.0/24 is directly connected, Vlan101
C 10.19.1.0/24 is directly connected, Vlan91
C 10.18.0.0/24 is directly connected, Vlan80
C 10.19.0.0/24 is directly connected, Vlan90
C 10.18.1.0/24 is directly connected, Vlan81
C 10.16.3.0/24 is directly connected, Vlan63
C 10.17.1.0/24 is directly connected, Vlan71
C 10.16.0.0/24 is directly connected, Vlan60
C 10.17.0.0/24 is directly connected, Vlan70
C 10.16.1.0/24 is directly connected, Vlan61
C 10.20.0.0/24 is directly connected, Vlan100
C 10.20.1.0/24 is directly connected, Vlan101
C 10.16.5.0/24 is directly connected, Vlan65
R 10.113.0.0/16 [120/1] via 10.10.11.30, 00:00:18, Vlan1
S* 0.0.0.0/0 [1/0] via 10.10.0.253
Business Accounts
Answer for Membership
by: QuoriPosted on 2009-10-29 at 16:35:01ID: 25699192
Good grief.
Is there anything else plugged into switch with ip 10.10.11.7?
I pressume that the distribution switch is doing all the inter-VLAN routing? If so you'll be best off plugging the ASA into the distribution switch, and extending a dot1q trunk to it then simply create your interfaces as such (assuming VLANs 10, 63, 73):
interface Ethernet0/2
no nameif
no security-level
no ip address
!
interface Ethernet0/2.10
vlan 10
nameif Inside
security-level 100
ip address 10.10.0.253 255.255.255.0
!
interface Ethernet0/2.63
vlan 63
nameif Inside
security-level 100
ip address 10.16.3.253 255.255.255.0
!
interface Ethernet0/2.73
vlan 73
nameif Inside
security-level 100
ip address 10.17.3.253 255.255.255.0
!
Otherwise if you extend all VLANs onto the switch between the ASA/PIX and the distribution switch this will also work. The key is you just need to extend each layer 2 segment over the trunk from distribution to 'switch' then extend out to ASA/PIX over trunk to it.