topic The only way I've found to in Network Security

ASA 5585 - same vlan id on different physical interfaces

TOBIAS HENKES — Tue, 12 Mar 2019 09:18:07 GMT

We are running an ASA 5585 connecting different switch infrastructures with trunk interfaces.

On trunk ten2/0 we have vlan 200, 201 and 203 (for vtp domain xxx)

On trunk ten2/1 we have vlan 204, 205 and 206 (for vtp domain yyy)

Now I need to add vlan 200 in vtp yyy on the trunk of ten2/1 and get the error:

ERROR: VLAN 200 has been assigned to another interface

Any idea how to solve this problem, without reconfiguring the vlan id on one of the switch infrastructures?

Sorry but I don't believe you

Marvin Rhoads — Tue, 02 May 2017 15:40:39 GMT

Sorry but I don't believe you can do that with the ASA. It won't tag two different VLANs with the same 802.1q tag.

This is because it has no awareness of the different switching domains and would thus insist that you are attempting an invalid configuration.

The only way I've found to

James Leinweber — Tue, 02 May 2017 21:47:41 GMT

The only way I've found to share a vlan tag across interfaces is to have the vlan tag on a single sub-interface, and to dedicate an entire physical interface to the same tag on the upstream switchport. This came up when I was renumbering a subnet.

-- Jim Leinweber, WI State Lab of Hygiene

I know, that it is not

TOBIAS HENKES — Wed, 03 May 2017 05:42:31 GMT

I know, that it is not working, as it is writen in the ASA documentation:

"... you cannot assign the same VLAN to multiple subinterfaces ..."

But I have this problem and I'm looking for a solution or work around.

It is just a simple example, as my configuration is about 50 vlans per interfaces and due to a new project I have multiple clashes.

My last idea is to configure another ASA to one of the switch infrastructures and connect both ASA with a transit vlan. But this is not realy a smart solution.

Just a thought - I haven't

Marvin Rhoads — Wed, 03 May 2017 05:49:03 GMT

Just a thought - I haven't done this myself - could you use multiple contexts with the outside of one linking to the inside of the other one?

That's kind of like what you're saying with a transit VLAN but all on one appliance.