Trunk Cisco Catalyst 2960 from another Catalyst and then to an ASA 5510

Posted on 2009-04-26
Last Modified: 2012-05-06
We will be routing all of our remote locations (directly connected via fiber) to our new corporate center and will be utilizing roughly 24 VLAN's.  The local ISP is providing a Cisco Catalyst (do not know the series off-hand) as a demarc point and will be setting up the actual VLAN's.

From their switch, we need to trunk it into our Catalyst 2960. I would like to know how to correctly set this up.

Then from our Catalyst 2960, we need to trunk to an ASA 5510 with the Security Plus package, which we will be using as a router-on-a-stick which we will use with different sub-interfaces and security contexts to route and provide security for each of the VLAN's.  If possible, it would be great to have some help here too.

I would simply like to compare against what I have planned, to see if I am missing any steps or if there is a better way of doing things; thanks.
Question by:Tercestisi
    LVL 3

    Accepted Solution

    On the port coming from the service provider's switch set it to the following values.

    int FastEthernet 0/1
    description "Trunk from Service Provider"
    switchport mode trunk
    switchport trunk encapsulation dot1q (most providers use 802.1q vlan trunking)
    speed 10 (or 100 depending on what the providers switch will be hard coded to)
    duplex full (this can be important)

    int FastEthernet 0/24
    description "Trunk to ASA Firewall)
    switchport mode trunk
    switchport trunk encapsulation dot1q
    speed 100
    duplex full

    You will configure the ASA Outside interface in the same way to accept the trunk from the 2960

    Author Comment

    Thanks, that is what I have minus the duplex and speed specifications.

    Can I set speed to 1000 if both interfaces are gigabit?

    Is routing between the VLAN's then as simple as setting up ACL's?
    LVL 3

    Expert Comment

    You can only set the speed if the other side of the connection is set for 1000 Mbps also. The routing for the vlans will have to be done on your asa since you are passing them as a trunk into that unit.
    You will have to setup SVI's (Switched virtual Interfaces) or Vlan interfaces to do your routing on the ASA unit.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Top 6 Sources for Identifying Threat Actor TTPs

    Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

    This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
    Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    Internet Business Fax to Email Made Easy - With eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

    794 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now