topic Re: Modify Vlan ID on ASA interface in Network Security

Modify Vlan ID on ASA interface

LuigiDiFronzo9542 — Thu, 01 Jun 2023 17:24:18 GMT

Hello,

There are 2 ASA 5545 ver 9.14 in HA, and there is a subinterface associated with an ISP and another subinterface associated with a second ISP. We need to change one subinterface with a diferent Vlan id as well as the subinterface id for standarization.

What would be the best strategy for that change? The change will interrupt the access for the other subinterface?.

Thanks

Re: Modify Vlan ID on ASA interface

Rob Ingram — Thu, 01 Jun 2023 17:33:44 GMT

@LuigiDiFronzo9542 I'd probably just create another sub-interface on the ASA and the connected interface leading to the ISP hardware. You would then need to amend any NAT and ACL configuration to reflect the new nameif. Once that is working you can then remove the old sub-interface.

Adding or changing a sub-interface would not cause a problem for the other sub-interface that hasn't changed.

Re: Modify Vlan ID on ASA interface

LuigiDiFronzo9542 — Thu, 01 Jun 2023 17:34:28 GMT

Thank you Rob,

In this case I forgot to mention that the IP address of the subinterface to be changed, will be the same.

Re: Modify Vlan ID on ASA interface

Rob Ingram — Thu, 01 Jun 2023 18:12:22 GMT

@LuigiDiFronzo9542 I am pretty sure you cannot change the subinterface ID of an interface, you can certainly change the VLAN number. You'd have to recreate a new sub-interface using your new standardised convention. Bear in mind if you delete the old sub interface, recreate using the new naming convention and reuse the original nameif, you will have to recreate the NAT and associate the ACL to the interface.

Or just change the VLAN ID and leave the subinterface ID using the old naming convention.

Re: Modify Vlan ID on ASA interface

MHM Cisco World — Thu, 01 Jun 2023 21:10:04 GMT

I think you have SW, because same physical two subinterface can not connect without SW.
NOW
add the new subinterface, add NAT add ACL...etc.
in SW add this new VLAN
NOW in SW re-config the interface connect to ISP from OLD VLAN-ID to NEW VLAN-ID

the traffic will disrupt ? Yes traffic may be effect by this change. so it safe to do in maintenance window

Re: Modify Vlan ID on ASA interface

LuigiDiFronzo9542 — Thu, 01 Jun 2023 21:18:17 GMT

Thanks MHM,

In fact the interface is connected to a switch, and the modifications ocurred because a change of Vlan number at Sw level. So the number of Vlan was changed and now we must reconfigure in ASA this new Vlan number. In fact the IP of subinterface is the same as well as the gateway.

Re: Modify Vlan ID on ASA interface

MHM Cisco World — Fri, 02 Jun 2023 10:40:25 GMT

if you want to do change without effect the traffic then
A- you use ECMP, if yes then stop use it and shift the traffic via other ISP
B- if you use one path for default route toward the ISP you want to change VLAN0ID for it then shit traffic to other ISP

add subinterface with different VLAN-ID the FW will accept this step BUT the FW will not accept assign two different interface/subinterface with same subnet, so you need to delete IP from OLD subinterface and add IP to NEW subinterface.