vlan trunking with PIX 515E

Here's my scenario:

I have a PIX 515E with Interface 4 going into my DMZ VLAN which is on my 3750 stack.  I've created a guest vlan in my stack and a vlan interface on the pix off of interface 4.  This vlan interface is 4.12.  I understand I need to trunk the port on my switch to see the vlan's on this interface.  Here's what I've put:

Gi1/0/25
switchport trunk encapsulate dot1q
switchport mode trunk
switchport trunk allowed vlan 12,15

However when i do this i can't get a reponse back.  Can someone help?
bigz71Asked:
Who is Participating?
 
lrmooreCommented:
> switchport mode access
Needs to be switchport mode trunk
0
 
lrmooreCommented:
What version PIX OS? How did you create the vlan interface?
That looks like the correct config for the switch side. You might need to create 2 logical subifs on the PIX now that you have 2 vlan tags.

0
 
bigz71Author Commented:
i'm running version 7 on the pix.  The DMZ interface is native and the GUEST interface is a vlan off the DMZ.  DMZ is Interface 4 and GUEST is Interface 4.12
0
Managing Security & Risk at the Speed of Business

Gartner Research VP, Neil McDonald & AlgoSec CTO, Prof. Avishai Wool, discuss the business-driven approach to automated security policy management, its benefits and how to align security policy management with business processes to address today's security challenges.

 
lrmooreCommented:
The native interface is expecting no vlan tag, where you are tagging 2 different vlans. It works fine as long as you were connected to an access port. Create another logical vlan interface 4.15 for vlan 15 and remove the ip address from the physical interface 4
0
 
bigz71Author Commented:
Here's what my firewall looks like now and it still doesn't work:

interface Ethernet4
 nameif Trunk
 security-level 0
 no ip address
!
interface Ethernet4.12
 description GUEST
 vlan 12
 nameif GUEST
 security-level 25
 ip address 192.168.12.254 255.255.255.0
!
interface Ethernet4.15
 description DMZ
 vlan 15
 nameif DMZ
 security-level 70
 ip address 192.168.15.254 255.255.255.0
0
 
bigz71Author Commented:
and this is what my switch looks like:

!
interface GigabitEthernet1/0/25
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 12,15
 switchport mode access
!
interface GigabitEthernet2/0/25
 switchport trunk encapsulation dot1q
 switchport trunk allowed vlan 12,15
 switchport mode access
!
I have two firewalls...
0
 
bigz71Author Commented:
changed to switchport mode trunk and still no luck...
0
 
lrmooreCommented:
Can you post result of 'show interface' from the PIX showing those three interfaces?
Did you cycle the interface on the switch and/or PIX? shut/no shut?
0
 
bigz71Author Commented:
Yes a shut/no shut was performed on the stack and the PIX.  Here's the config:  

btw thanks for the help so far

Interface Ethernet4 "Trunk", is up, line protocol is up
  Hardware is i82559, BW 100 Mbps
        Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
        MAC address 000d.8811.94b6, MTU 1500
        IP address unassigned
        112133914 packets input, 49387809096 bytes, 0 no buffer
        Received 2238824 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        1423 L2 decode drops
        97705257 packets output, 27967621576 bytes, 0 underruns
        0 output errors, 0 collisions, 0 interface resets
        0 babbles, 0 late collisions, 0 deferred
        5 lost carrier, 0 no carrier
        input queue (curr/max blocks): hardware (128/128) software (0/40)
        output queue (curr/max blocks): hardware (0/30) software (0/3)
  Traffic Statistics for "Trunk":
        112260370 packets input, 47638335615 bytes
        97800990 packets output, 26208047060 bytes
        455188 packets dropped
      1 minute input rate 0 pkts/sec,  0 bytes/sec
      1 minute output rate 0 pkts/sec,  0 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 0 pkts/sec,  0 bytes/sec
      5 minute output rate 0 pkts/sec,  0 bytes/sec
      5 minute drop rate, 0 pkts/sec
Interface Ethernet4.12 "GUEST", is up, line protocol is up
        VLAN identifier 12
        Description: GUEST
        MAC address 000d.8811.94b6, MTU 1500
        IP address 192.168.12.254, subnet mask 255.255.255.0
  Traffic Statistics for "GUEST":
        456 packets input, 22800 bytes
        5 packets output, 140 bytes
        456 packets dropped
Interface Ethernet4.15 "DMZ", is up, line protocol is up
        VLAN identifier 15
        Description: DMZ
        MAC address 000d.8811.94b6, MTU 1500
        IP address 192.168.15.254, subnet mask 255.255.255.0
  Traffic Statistics for "DMZ":
        627 packets input, 34208 bytes
        82 packets output, 5804 bytes
        603 packets dropped
0
 
bigz71Author Commented:
increased this by 65 more points... all i have for now!  
0
 
bigz71Author Commented:
anybody?  My DMZ is currently down and I need to bring it back asap!
0
 
lrmooreCommented:
Sorry to leave you hanging.  Hope you were able to get back to where you were at least.
Whenever you change up interfaces like you did with the dmz interface to a sub interface, you also have to adjust all your statics, nats, and access-lists to match the new interface
0
 
bigz71Author Commented:
i figured out the issue... it was my static nat's... i guess thats what happens when you work at 2am... points awarded to you.
0
 
lrmooreCommented:
Glad you got it sorted.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.