Cisco ASA 5505 and Cisco SG300 Switch VLAN Setup
Posted on 2013-12-05
I'm trying to setup a new vlan and I'm having some issues.
Here's the setup...
- We have a Cisco ASA 5505 with three interfaces - outside, inside and proxy.
- The default inside interface (ID 1) with the IP 192.168.45.1 (subnet 255.255.255.0)
- The 'proxy' vlan (ID 12) is the new vlan we just added to the ASA (and, yes, we do have the license for the additional vlans) with the IP 192.168.40.1 (subnet 255.255.255.0)
- We do NOT want/need hosts on these two different subnets to talk to each other.
- Both interfaces (vlan 1 and 12) are connected via one cable for each interface to the same Cisco SG300-28 switch.
- The switch is currently in L2 mode.
- I created a new vlan on the switch with ID 12 and name 'proxy'.
- I then assigned vlan membership to every port on the switch. The mode of every port is "Trunk" and the Operational VLANs for every port is "1UP,12T".
As far as I know, this is all I need to do. But here's the problem...
- In this setup, with a client computer attached to the SG300 with an IP of 192.168.40.10, I cannot get on the web. I can't even ping the ASA proxy interface (192.168.40.1). NOTE: When running a ping, it is successful about 1 or 2 times out of every 15.
- If I connect the client computer directly to the proxy interface on the ASA, it works perfectly - web and pings.
- If I disconnect the cable for the INSIDE interface from the ASA to the switch, then the proxy vlan works fine.
So apparently when both cables from the two ASA interface to the switch are plugged in, it appears (based on the ping working every once in a while) as though only a tiny fraction of the traffic is going to the correct interface on the ASA.
I've been on the phone with Cisco for both the ASA and switch and they aren't sure why it wouldn't be working as everything appears to be configured correctly.