topic Re: 5506-x no switch option as 5505? in Network Security

5506-x no switch option as 5505?

leo.espinosa — Fri, 10 Apr 2015 23:11:58 GMT

Just bought a new ASA 5506-x to play with it, and found out the 8 ports cannot be configured as a switch in the same way we do with ASA5505.

There are any option to use the remaining ports as a switch?

Re: 5506-x no switch option as 5505?

brremmel — Mon, 13 Apr 2015 20:07:42 GMT

Unlike ASA5505, ASA5506-X does not support switch ports at this time.

Re: 5506-x no switch option as 5505?

S M85 — Fri, 01 May 2015 12:45:09 GMT

Hi Brian, are you Cisco Employee? Do you know the timeframe when support is coming. The 5506 is the successor of the 5505. Pretty weird if you don't get the same (essential) features in the new hardware.

Re: 5506-x no switch option as 5505?

brremmel — Fri, 01 May 2015 18:19:21 GMT

Hi Sander,

Yes, I am a Cisco employee. I'm investigating this and will get back to you.

Thanks,

Brian

Re: 5506-x no switch option as 5505?

clockworthy — Mon, 04 May 2015 17:34:28 GMT

This is a pretty big miss on Cisco's side. How is this supposed to be a replacement for the Cisco ASA 5505?

Is there an ETA for when the switch port feature will be available for the ASA 5506X?

Re: 5506-x no switch option as 5505?

jessiestarns — Tue, 05 May 2015 13:04:38 GMT

HI,

Is there an update on this? This is a pretty big mess for everyone that was expecting to be able to use the 5506 the same way as the 5505.

Thanks,5506-x no switch option as 5505?

Re: 5506-x no switch option as 5505?

tmcarter — Tue, 05 May 2015 13:58:41 GMT

Brian:

I respectfully have to disagree...

Its all in a matter of knowing how to maneuver around the various options and the lack of youtube videos and config examples for real world configs are very challenging here, to say the lease..

This is a very simple accomplishment that will group all the ports into a logical switch and assign each port to a group.. We will be using a concept of etherchannels or port-channels as Cisco defines them... Here is the example.

NOT GROUPED	GROUPED
interface GigabitEthernet1/1	interface GigabitEthernet1/1
nameif outside	nameif outside
security-level 0	security-level 0
ip address 1.1.1.1 255.255.255.0	ip address 1.1.1.1 255.255.255.0
!	!
interface GigabitEthernet1/2	interface GigabitEthernet1/2
nameif inside	no nameif
security-level 100	no security-level
ip address 192.168.1.1 255.255.255.0	no ip address
!	!
interface GigabitEthernet1/3	interface GigabitEthernet1/3
no nameif	channel-group 1 mode active
no security-level	no nameif
no ip address	no security-level
!	no ip address
interface GigabitEthernet1/4	!
no nameif	interface GigabitEthernet1/4
no security-level	channel-group 1 mode active
no ip address	no nameif
!	no security-level
interface GigabitEthernet1/5	no ip address
no nameif	!
no security-level	interface GigabitEthernet1/5
no ip address	channel-group 1 mode active
!	no nameif
interface GigabitEthernet1/6	no security-level
no nameif	no ip address
no security-level	!
no ip address	interface GigabitEthernet1/6
!	channel-group 1 mode passive
interface GigabitEthernet1/7	no nameif
no nameif	no security-level
no security-level	no ip address
no ip address	!
!	interface GigabitEthernet1/7
interface GigabitEthernet1/8	channel-group 1 mode passive
no nameif	no nameif
no security-level	no security-level
no ip address	no ip address
!	!
interface Management1/1	interface GigabitEthernet1/8
management-only	no nameif
nameif management	no security-level
security-level 100	no ip address
ip address 192.168.15.13 255.255.255.0	!
	interface Management1/1
	management-only
	nameif management
	security-level 0
	ip address 192.168.15.13 255.255.255.0
	!
	interface Port-channel1
	lacp max-bundle 8
	nameif inside
	security-level 100
	ip address 192.168.1.1 255.255.255.0

As you can see the column labeled "Grouped" will arrange all the specified ports into a LACP etherport channel group, logically creating two separate segments, much like a VLAN; however there are substantial other config items that must be configured in order for this to work successfully; however it will work and function as a L2 switch, just as described...

I will post more examples and comments as I come across issues that plague me as well...

I would suggest instead of saying the latest ASA5506-X does not support switch ports or "X" you may want to fully investigate the broad range of options available to the resource users... Lack of knowledge doesn't constitute the intended use of product support.

There is not much this robust ASA5506-X platform can not do, given, time, patience and the willingness to not rely on a point and click solution.

Our company will be glad to support any users on this platform, of course for a small fee.. Please feel free to reach out with your request and we can move forward... This is a great and rocksolid brand new product; which WILL REQUIRE relearning some basic 5505 mentality; but again.. no videos, docs or real world examples are available yet... I think this is probably the first of many to come...

Regards,

Ty Carter, President

Strategic Network Consultants, Inc.

524 East 9^th Street

Washington, NC 27889

Re: 5506-x no switch option as 5505?

leo.espinosa — Tue, 05 May 2015 15:21:06 GMT

Etherchannels will work when you connect the new ASA 5506 to another switch. A matter of adapt, i agree.

However, when no switch around, and you see this often in small remote offices/ soho (4-5 devices), what are you going to do?

Are you going to ask the customer to buy a switch for that??? no good.

The ASA 5505 was cheap, simple and it worked perfect.

To Cisco: If it ain't broke, don't fix it

Re: 5506-x no switch option as 5505?

tmcarter — Tue, 05 May 2015 15:25:57 GMT

I don’t believe you have to attach the device to another switch… The IOS will create its own grouping internally… I am going to put this to the test tomorrow…

I agree wholeheartedly it is a definite change in dynamic; but that was not the question posed here… I didn’t say I liked it any more than the next person.

We will see where this takes us.. at least this is according to TAC group.

Re: 5506-x no switch option as 5505?

clockworthy — Tue, 05 May 2015 15:28:49 GMT

Here is the information I got from the Partner Virtual Team Support group.

Q. We just got our first ASA 5506 and found out that we cannot configure VLAN interface on it like the 5505.

This is a big problem if we are trying to position the 5506 as a replacement for the 5505.

...

Can you look into when/if this feature is going to be available?

A. The ASA5506 does not have switch ports as the old ASA5506. The ASA5506 is similar to the ASA5512 and 5515 from a

configuration perspective.

Based on our internal resources, for now there are no plans to implement switch ports on the ASA5506.

Q. Can you explain why this is not a feature of the ASA 5506?

A. Because the ASA5506-X includes all routed ports, there is currently no built-in switch capabilities like the ASA5505. Each port can be use as a WAN port.

Re: 5506-x no switch option as 5505?

matt.king — Tue, 05 May 2015 18:22:39 GMT

HI All

I am in a bit of a fix with this too. Some of the 5506-X links are connected to servers, PC's and printers in my case. I have been trying to find a way to get the 6 spare ports working as switchports. I have configured a Port-Channel which is up and showing ports as bundled. This appears to work only intermittently, some pings work some don't. I get arp for hosts but can't ping them so need to look at further.

I used Channel-group 1 mode on to force the Port-Channel up as I will get no lacp or pagp from anywhere and the Port-Channel interface showed as down with any other mode, as expected.

I will know more tomorrow as our customer is going to see what connectivity is like first thing.....

Not great though, already been caught out by the lack of POE, now a SOHO device will not do switchports. Maybe its not a SoHo device?

Re: 5506-x no switch option as 5505?

jessiestarns — Thu, 07 May 2015 17:26:20 GMT

So we had a call with Cisco yesterday concerning this new 5506 and asked them some very direct questions:

Q: We currently use the 5505 as a SOHO solution using EZVPN with a pair of 5525's at the head-end. Will the 5506's work? Keep in mind that we use these as a primary means of connectivity for home users that have dynamic ip addresses.

A: Yes, if the 5506 has a static ip address it will work with the 5525 via a s2s tunnel. (not feasible for us) If they are using dynamic ip addresses, these will not work.

Then Cisco recommended we checkout the Meraki line of new stuff: meraki.cisco.com. (basically a new solution for SOHO I gathered).

Basically, we asked them about of EOL/EOS for the 5505 and they couldn't/wouldn't tell us. It basically just screws us with the investment we've made in the last year with the 5505's.

We're not happy, not happy at all.

Re: 5506-x no switch option as 5505?

Matthew Hall — Wed, 20 May 2015 04:40:57 GMT

Yeah...using LACP is not a solution, I would never try and hack that together for a production system....not to mention it won't work correctly due to LACP load balancing issues.

This lack of switch ports is doubly bad for those users who are using 5505 with switchports as a soho in a box.

You can use the 5506 using aggressive mode tunnels as a replacement for ezvpn (it's aggressive mode), but you lose the group key...I guess ikev2 is maybe an ok alternative as it uses asynchronous preshared keys.

No switch as stated means cisco can sell you another box. Especially since it has no POE.

Meraki...this means a whole new infrastructure (more sales) and it also means no POE. This effectively means Cisco doesn't have SOHO solution with built in POE anymore. This is a huge pain if you are using a 5505 to drive a phone and wireless AP...Especially if the AP is distant remote...basically, yes another thing to buy (POE injector).

Re: 5506-x no switch option as 5505?

dkingfx00 — Fri, 05 Jun 2015 15:20:19 GMT

Do we know if this is software limitation or both software and hardware?

Re: 5506-x no switch option as 5505?

v-chrisi — Thu, 18 Jun 2015 19:26:14 GMT

Hi Ty-

Have you actually tested this with a PC connected to a channel-group1 port?

I have this setup in the lab and ran into the same issues as everyone else. We use the 5505 as a one box solution and this forces us to buy a second switch which kills our design and increases our points of failure not to mention Smartnet fees for two devices. I thought maybe your solution would work for us but I am unable to receive an address via DHCP. We use the ASA for DHCP and when I try to configure the port-channel we never receive an address. Once I remove the port-channel and use a physical interface the ASA assigns the DHCP address no problem. I'm wondering if this was a solution in theory or if it has actually been vetted.

Re: 5506-x no switch option as 5505?

jason.christopher — Mon, 29 Jun 2015 08:16:17 GMT

I would like to know this too. I've read countless posts now and the fact that you have to use a kludgy hack to utilize ports on a network device that costs $1500 dollars is absolutely inexcusable. Cisco needs a serious smack in the ass. They are so transparently selfish with their focus on costs and returns; any lay-person can see that they actually sit down and develop ways to intentionally gouge customers.

The simple brainless return on this problem is "now I need to buy a switch", which is exactly what they intended. Now ask yourself what kind of people run this company.

Re: 5506-x no switch option as 5505?

thompson318 — Mon, 06 Jul 2015 21:54:51 GMT

I was really looking forward to the next generation of the 5505, lack of switch port and PoE is something. I had to read things twice as I couldn't understand how they would release it without these options. Does anyone know the lifecycle of the 5505? To bad though the age is coming out in the performance.

Re: 5506-x no switch option as 5505?

maverick5 — Sat, 11 Jul 2015 19:13:45 GMT

Brian,

Have there been any updates on this limitation of the 5506-X, specifically the lack of switch-ports? If the ASA5505 is End-of-Life, and the ASA5506-X is the recommended replacement, the lack of this functionality is a big non-starter.

It is useful to note that none of the aforementioned "workarounds" in this thread are viable.

-thanks

Re: 5506-x no switch option as 5505?

wireddirect — Wed, 22 Jul 2015 03:36:38 GMT

We sold about ten of these already . Day one we got it and tried to enable the switch and ran into this issue .. Contacted TAC and was told that feature is not available because they are gig ports . So we just decided to combine 200 or 300 SB switch's and keep it as a straight firewall device . Firepower features are pretty and a lot faster that the old 5505 . More likely Cisco will resolve this is but with no POE and limited N wifi support I would rather buy switch and AC based ap's. ..

Re: 5506-x no switch option as 5505?

mbluemel — Wed, 29 Jul 2015 08:37:52 GMT

Hi all. I have had the same issue but looking at the ASDM on one this morning I saw the Zone option on the interfaces. It appears you can add interfaces to the inside from this tab. Unfortunately the only 5506 I have is on a remote site that is mostly unmanned so I cannot test it. Does anyone have one handy they could test with? Running 9.3(3).