gopher_49
asked on
creating virtual or sub interface on a Cisco ASA 5505
I'm wanting to create a sub interface or a logical interface on a ASA 5505. I tried the commands:
interface Ethernet 0/1.3
vlan 3
nameif wireless
security-level 50
ip address 192.168.13.1 255.255.255.0
and the 'interface Ethernet 0/1.3' doesn't work. What exact syntax do I use to accomplish the functionality of the commands listed above? I got the above to work on my 5510, but not my 5505. My 5505 is running v8.0.2
interface Ethernet 0/1.3
vlan 3
nameif wireless
security-level 50
ip address 192.168.13.1 255.255.255.0
and the 'interface Ethernet 0/1.3' doesn't work. What exact syntax do I use to accomplish the functionality of the commands listed above? I got the above to work on my 5510, but not my 5505. My 5505 is running v8.0.2
The 5505 doesn't use sub-interfaces because it is a switch. Just put one of the switchport interfaces into vlan 3
interface vlan 3
nameif wireless
security-level 50
ip address 192.168.13.1 255.255.255.0
no shut
interface Ethernet 0/1
switchport access vlan 3
no shut
This would be a physical connection to your switch into an access port in vlan 3 and not a trunk port with the switch.
interface vlan 3
nameif wireless
security-level 50
ip address 192.168.13.1 255.255.255.0
no shut
interface Ethernet 0/1
switchport access vlan 3
no shut
This would be a physical connection to your switch into an access port in vlan 3 and not a trunk port with the switch.
ASKER
So,
I would set the port that the ASA is plugged into to be untagged for VLAN id1 and tagged for vlan id3? Correct? Ethetnet 0/1 would then be handling traffic for both VLANs id 1 and id3... In return allowing my access point to have two SSID's. One for vlan id1 and one for vlan id3. They would both use the same outside interface... (you helped me a few days ago on my 5510) I got a little lost on the 5505 for it's a completely different beast...
I would set the port that the ASA is plugged into to be untagged for VLAN id1 and tagged for vlan id3? Correct? Ethetnet 0/1 would then be handling traffic for both VLANs id 1 and id3... In return allowing my access point to have two SSID's. One for vlan id1 and one for vlan id3. They would both use the same outside interface... (you helped me a few days ago on my 5510) I got a little lost on the 5505 for it's a completely different beast...
ASKER
lrmoore,
I figured this out last night, however, I have the below syntax. It made me add the 'no forward interface Vlan1' due to licensing. Below is the exact syntax I have for my interfaces.
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 74.93.158.129 255.255.255.252
!
interface Vlan3
no forward interface Vlan1
nameif wireless
security-level 50
ip address 192.168.13.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 3
This above syntax with the switch config I mentioned above should do it. The switch config mentioned above is how I had my ProCurve switches setup when using the 5510 and the 506e for this type of config.
I figured this out last night, however, I have the below syntax. It made me add the 'no forward interface Vlan1' due to licensing. Below is the exact syntax I have for my interfaces.
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 74.93.158.129 255.255.255.252
!
interface Vlan3
no forward interface Vlan1
nameif wireless
security-level 50
ip address 192.168.13.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 3
This above syntax with the switch config I mentioned above should do it. The switch config mentioned above is how I had my ProCurve switches setup when using the 5510 and the 506e for this type of config.
ASKER
lrmoore:,
What should I change for the config above doesn't work?!
What should I change for the config above doesn't work?!
Try this:
interface Ethernet0/1
no switchport access vlan 3
switchport mode trunk
This will connect to your switch's trunk port just like the old 506e
interface Ethernet0/1
no switchport access vlan 3
switchport mode trunk
This will connect to your switch's trunk port just like the old 506e
ASKER
So,
If I were to use the above syntax I could in return use two different SSID's on my access point. The private SSID going to vlan id 1 and the public SSID going to vlan id 3? I assume I configure the port the same as my other switch...
If I were to use the above syntax I could in return use two different SSID's on my access point. The private SSID going to vlan id 1 and the public SSID going to vlan id 3? I assume I configure the port the same as my other switch...
Yep..
ASKER
What about the other commands. Use the same commands that I had listed in my 506e? Please send me all commands needed.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
sweet. I'll give it a shot this evening or tomorrow.
Also make SURE that you do NOT have an internal VLAN 2 on the switch that also gets trunked out to the ASA...
ASKER
Please ellaborate more on your last statement. The port that the AP is plugged into is tagged for the below vlan's:
1 2 3
Vlan 1 is my default, vlan 2 is for the AP, and vlan 3 is unused.
The port that the PIX is plugged into is untagged for 1 ad NOT TAGGED for 2 and Tagged for 3
Is this okay?
1 2 3
Vlan 1 is my default, vlan 2 is for the AP, and vlan 3 is unused.
The port that the PIX is plugged into is untagged for 1 ad NOT TAGGED for 2 and Tagged for 3
Is this okay?
I think that using vlan2 for "outside" on the ASA and having a vlan 2 inside on the switch, tagged or not connected to a trunk port is asking for trouble.
I would suggest not using vlan2 on the switch for the wireless, but rather use vlan 3, tagged, and not use vlan 2 at all.
I would suggest not using vlan2 on the switch for the wireless, but rather use vlan 3, tagged, and not use vlan 2 at all.
ASKER
okay. Also, I get the below error when using the below command:
interface Ethernet0/1
switchport mode trunk
ERROR: Trunk port is not supported with this license -
Which license do I need to order? I'll order tomorrow in the morning.
interface Ethernet0/1
switchport mode trunk
ERROR: Trunk port is not supported with this license -
Which license do I need to order? I'll order tomorrow in the morning.
You might have to contact Cisco TAC on that one. All references I can find do not mention anything about licensing. There are not that many license options/choices
ASKER
okay. I'll email my Cisco rep.
thanks.
thanks.
Hi,
I have the same problem, I try to configure the interface Ethernet like mode trunk and the output is:
config-if)# switchport mode trunk
ERROR: Trunk port is not supported with this license
How did you solve this issue?
Thanks
I have the same problem, I try to configure the interface Ethernet like mode trunk and the output is:
config-if)# switchport mode trunk
ERROR: Trunk port is not supported with this license
How did you solve this issue?
Thanks
ALSO ON THE SWITCH IS THE TRUNKING ENABLED ??