Cisco ASA 5505 and Cisco SG300 Switch VLAN Setup

I'm trying to setup a new vlan and I'm having some issues.

Here's the setup...

- We have a Cisco ASA 5505 with three interfaces - outside, inside and proxy.
- The default inside interface (ID 1) with the IP (subnet
- The 'proxy' vlan (ID 12) is the new vlan we just added to the ASA (and, yes, we do have the license for the additional vlans) with the IP (subnet
- We do NOT want/need hosts on these two different subnets to talk to each other.
- Both interfaces (vlan 1 and 12) are connected via one cable for each interface to the same Cisco SG300-28 switch.
- The switch is currently in L2 mode.
- I created a new vlan on the switch with ID 12 and name 'proxy'.
- I then assigned vlan membership to every port on the switch. The mode of every port is "Trunk" and the Operational VLANs for every port is "1UP,12T".

As far as I know, this is all I need to do. But here's the problem...

- In this setup, with a client computer attached to the SG300 with an IP of, I cannot get on the web. I can't even ping the ASA proxy interface ( NOTE: When running a ping, it is successful about 1 or 2 times out of every 15.
- If I connect the client computer directly to the proxy interface on the ASA, it works perfectly - web and pings.
- If I disconnect the cable for the INSIDE interface from the ASA to the switch, then the proxy vlan works fine.

So apparently when both cables from the two ASA interface to the switch are plugged in, it appears (based on the ping working every once in a while) as though only a tiny fraction of the traffic is going to the correct interface on the ASA.

I've been on the phone with Cisco for both the ASA and switch and they aren't sure why it wouldn't be working as everything appears to be configured correctly.

Please help!!!
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Henk van AchterbergSr. Technical ConsultantCommented:
A computer, by default, does not use VLAN's and thus is always sending traffic untagged and dropping tagged traffic.

If you want to have PC in the proxy VLAN you should configure that port on the SG300 untagged in VLAN 12!

On the ASA you should connect one cable with the SG300 and configure it as trunk.
graphicodysseyAuthor Commented:
sorry, but if it's not obvious - vlans are still very new to me.

So, let me see if I have this right... the port with the cable that connects the switch to the ASA for vlan 12 should be in tagged operational mode with the vlan of 12. And the port for the client computer should be in untagged access mode? Then the switch knows to tag traffic coming from that client computer (which by default is untagged) as vlan 12 and then the switch knows that the port configured as a vlan 12 trunk is a bridge to get to the rest of the vlan 12 network (which in my case is the asa).

Is this correct?
Henk van AchterbergSr. Technical ConsultantCommented:
Let me explain this a little but more in detail.

By default the native vlan is 1. native means untagged. When you configure a port on the ASA 5505 as trunk then packets in vlan 1 will be sent untagged. Packets in other vlans will be tagged with the vlan number.

The SG300 has also configured vlan 1 untagged and vlan 12 tagged on the port to the ASA.

If you need your computer to be in vlan 1 then configure the port with vlan 1 untagged. When you need it to be in vlan 12 configure it as vlan 12 untagged.

The switch will combine all tagged and untagged ports for the vlans so it will appear as one network per vlan.

In short, you are correct.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SolarWinds® IP Control Bundle (IPCB)

Combines SolarWinds IP Address Manager and User Device Tracker to help detect IP conflicts, quickly identify affected systems, and help your team take near instantaneous action. Help improve visibility and enhance reliability with SolarWinds IP Control Bundle.

graphicodysseyAuthor Commented:
Ok, I think we're on the same page, but I have a couple questions...

Aren't untagged packets automatically tagged by the switch as the default vlan of 1 when they hit a managed switch? Thus, aren't untagged packets coming from the ASA automatically tagged as 1 or 12 (based on the interface they're coming from) when they leave the device?

Here's what I've done... left the switch in system mode L2. Reverted all ports to just vlan 1UP. Then I configured the port leading to the ASA as 12UP (so vlan 12, untagged, primary) and the port to the client computer also as 12UP. Doing this, everything started working perfectly. However, this is slightly different than what you recommended - which was that the port leading to the ASA should be configured as TAGGED vlan 12. But the SG300 won't allow me to do that - I must define some vlan as the untagged default. What do you think? Is this configuration good???
graphicodysseyAuthor Commented:
By the way, I've also left all ports in "TRUNK" mode instead of "ACCESS". From what I can tell, ACCESS mode may only be available in L3 mode???
Henk van AchterbergSr. Technical ConsultantCommented:
if you use two cables from the ASA to the switch you can use 12 untagged. if you want to use one cable you should use vlan 1 untagged and vlan 12 tagged.

access mode is allowing only the untagged vlan over the port.
graphicodysseyAuthor Commented:
I have a second SG300 that connects to the main SG300 over a single wire. There will be vlan 1 and 12 traffic coming from this second switch. So, based on your last comment, I need to configure the connecting ports on both of these two switches as 1UP and 12T, correct?

[HOST] --> 12UP [SWITCH] 1UP/12T --> 1UP/12T [SWITCH] 12UP --> vlan12 interface [ASA]

So basically anytime I want to transverse from one switch to another, I need untagged clan 1 and tagged 12 setup on the ports connecting the switches together. Is this correct?
Henk van AchterbergSr. Technical ConsultantCommented:
Yes it is!
graphicodysseyAuthor Commented:
Ok, thx so much for your help!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking Hardware-Other

From novice to tech pro — start learning today.