topic Marvin in Network Security

Issue on VLAN 1 with ASA 5516-X

VCsupport17 — Tue, 12 Mar 2019 09:25:50 GMT

Hello Community,

We have Cisco ASA 5516-X Firepower Threat Defense and connected to Cisco 3850 core switch.

I created VLANs on the 3850 switch and create sub-interface on the ASA 5516-X FTD. My DHCP server is the 3850 switch.

My issue is VLAN 1 won't work in my setup. I have created other VLANs and work fine. I have VLAN 10 and 11 and works fine, i can get internet connection on these VLAN and can reach each other VLAN. But if a device on the VLAN 1, no internet and cannot reach other VLANs. Cannot also reach the gateway (sub-interface of the ASA 5516-X).

What need to check?

Here's what I'd start

Marvin Rhoads — Mon, 29 May 2017 14:58:43 GMT

Here's what I'd start checking:

Is the SVI up/up on the switch?

Does the switch get an ARP entry for the ASA VLAN 1 subinterface?

Does the ASA get an ARP entry for the SVI?

Is the trunk from the switch in spanning tree forwarding state for VLAN 1?

Marvin

Jon Marshall — Mon, 29 May 2017 14:58:44 GMT

Marvin

Would this have anything to do with the native vlan and using the physical interface on the ASA ?

If so to the OP, you can either put the vlan 1 IP address on the physical interface on the ASA or you can change the native vlan to an unused vlan on the trunk ie. on the switch "switchport trunk native vlan <vlan ID>".

Jon

Ah good point Jon - I think

Marvin Rhoads — Mon, 29 May 2017 15:35:23 GMT

Ah good point Jon - I think you may be correct.

I don't have one handy to lab it up right now but I do recall that the ASA only accepts tagged traffic when you are using subinterfaces. By default VLAN 1 would be untagged from the switch. I found a thread from 10 years back mentioning this:

https://supportforums.cisco.com/discussion/10113801/how-create-trunk-port-asa-5520

Your proposed solution makes sense. Setting the native VLAN to anything other than VLAN 1 on the switch side should indicate to it that it must tag VLAN 1 traffic on that trunk.

Hi Jon and Marvin,

VCsupport17 — Tue, 30 May 2017 04:51:26 GMT

Hi Jon and Marvin,

Thank you for your helpful responses. Now i made my VLAN 1 working after doing your suggestions.

I remove VLAN 1 on the ASA sub-interface and put it on the Physical interface with its IP address and did work! 🙂

Thank you for you help.