Link to home
Start Free TrialLog in
Avatar of gopher_49
gopher_49

asked on

creating virtual or sub interface on a Cisco ASA 5505

I'm wanting to create a sub interface or a logical interface on a ASA 5505.  I tried the commands:

interface Ethernet 0/1.3
 vlan 3
 nameif wireless
 security-level 50
 ip address 192.168.13.1 255.255.255.0

 and the 'interface Ethernet 0/1.3' doesn't work.  What exact syntax do I use to accomplish the functionality of the commands listed above?  I got the above to work on my 5510, but not my 5505.  My 5505 is running v8.0.2
Avatar of charan_jeetsingh
charan_jeetsingh

U NEED TO USE "NO SHUTDOWN"

ALSO ON THE SWITCH IS THE TRUNKING ENABLED ??
Avatar of Les Moore
The 5505 doesn't use sub-interfaces because it is a switch. Just put one of the switchport interfaces into vlan 3

interface vlan 3
 nameif wireless
 security-level 50
 ip address 192.168.13.1 255.255.255.0
 no shut
interface Ethernet 0/1
 switchport access vlan 3
 no shut

This would be a physical connection to your switch into an access port in vlan 3 and not a trunk port with the switch.


Avatar of gopher_49

ASKER

So,

I would set the port that the ASA is plugged into to be untagged for VLAN id1 and tagged for vlan id3?  Correct?  Ethetnet 0/1 would then be handling traffic for both VLANs id 1 and id3...  In return allowing my access point to have two SSID's.  One for vlan id1 and one for vlan id3.  They would both use the same outside interface...  (you helped me a few days ago on my 5510)  I got a little lost on the 5505 for it's a completely different beast...
lrmoore,

I figured this out last night, however, I have the below syntax.  It made me add the 'no forward interface Vlan1' due to licensing.  Below is the exact syntax I have for my interfaces.

interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 74.93.158.129 255.255.255.252
!
interface Vlan3
 no forward interface Vlan1
 nameif wireless
 security-level 50
 ip address 192.168.13.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3

This above syntax with the switch config I mentioned above should do it.  The switch config mentioned above is how I had my ProCurve switches setup when using the 5510 and the 506e for this type of config.
lrmoore:,

What should I change for the config above doesn't work?!
Try this:
interface Ethernet0/1
 no switchport access vlan 3
 switchport mode trunk

This will connect to your switch's trunk port just like the old 506e
So,

If I were to use the above syntax I could in return use two different SSID's on my access point.  The private SSID going to vlan id 1 and the public SSID going to vlan id 3?  I assume I configure the port the same as my other switch...
Yep..
What about the other commands.  Use the same commands that I had listed in my 506e?  Please send me all commands needed.
ASKER CERTIFIED SOLUTION
Avatar of Les Moore
Les Moore
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
sweet.  I'll give it a shot this evening or tomorrow.

Also make SURE that you do NOT have an internal VLAN 2 on the switch that also gets trunked out to the ASA...
Please ellaborate more on your last statement.  The port that the AP is plugged into is tagged for the below vlan's:

1 2 3

Vlan 1 is my default, vlan 2 is for the AP, and vlan 3 is unused.  

The port that the PIX is plugged into is untagged for 1 ad NOT TAGGED for 2 and Tagged for 3

Is this okay?
I think that using vlan2 for "outside" on the ASA and having a vlan 2 inside on the switch, tagged or not connected to a trunk port is asking for trouble.
I would suggest not using vlan2 on the switch for the wireless, but rather use vlan 3, tagged, and not use vlan 2 at all.
okay.  Also, I get the below error when using the below command:

interface Ethernet0/1
 switchport mode trunk

ERROR: Trunk port is not supported with this license -

Which license do I need to order?  I'll order tomorrow in the morning.
You might have to contact Cisco TAC on that one. All references I can find do not mention anything about licensing. There are not that many license options/choices
okay.  I'll email my Cisco rep.  

thanks.
Hi,

I have the same problem, I try to configure the interface Ethernet like mode trunk and the output is:

config-if)# switchport mode trunk
ERROR: Trunk port is not supported with this license

How did you solve this issue?

Thanks