topic Re: ASA VLAN subinterfaces in Network Security https://community.cisco.com/t5/network-security/asa-vlan-subinterfaces/m-p/949038#M419895 <HTML><HEAD></HEAD><BODY><P>If you use subinterfaces, you typically do not also want the physical interface to pass traffic, because the physical interface passes untagged packets. Because the physical interface must be enabled for the subinterface to pass traffic, ensure that the physical interface does not pass traffic by leaving out the nameif command. If you want to let the physical interface pass untagged packets, you can configure the nameif command as usual. </P><P></P><P>The configuration of security levels on sub-interface is the same as physical interfaces. Here's a document on security levels.</P><P></P><P><A class="jive-link-custom" href="http://cisco.com/en/US/docs/security/asa/asa70/configuration/guide/intparam.html" target="_blank">http://cisco.com/en/US/docs/security/asa/asa70/configuration/guide/intparam.html</A></P><P></P><P>HTH</P></BODY></HTML> Fri, 14 Mar 2008 13:43:48 GMT Collin Clark 2008-03-14T13:43:48Z ASA VLAN subinterfaces https://community.cisco.com/t5/network-security/asa-vlan-subinterfaces/m-p/949037#M419894 <P>When I configure subinterfaces on an ASA, how does the security level of the physical interface interact with the security levels of the subinterfaces? Can I make the subinterfaces security levels different from the security level of the physical interface and how is this handled?</P><P></P><P>TIA</P> Fri, 21 Feb 2020 09:56:25 GMT https://community.cisco.com/t5/network-security/asa-vlan-subinterfaces/m-p/949037#M419894 f00f1ter 2020-02-21T09:56:25Z Re: ASA VLAN subinterfaces https://community.cisco.com/t5/network-security/asa-vlan-subinterfaces/m-p/949038#M419895 <HTML><HEAD></HEAD><BODY><P>If you use subinterfaces, you typically do not also want the physical interface to pass traffic, because the physical interface passes untagged packets. Because the physical interface must be enabled for the subinterface to pass traffic, ensure that the physical interface does not pass traffic by leaving out the nameif command. If you want to let the physical interface pass untagged packets, you can configure the nameif command as usual. </P><P></P><P>The configuration of security levels on sub-interface is the same as physical interfaces. Here's a document on security levels.</P><P></P><P><A class="jive-link-custom" href="http://cisco.com/en/US/docs/security/asa/asa70/configuration/guide/intparam.html" target="_blank">http://cisco.com/en/US/docs/security/asa/asa70/configuration/guide/intparam.html</A></P><P></P><P>HTH</P></BODY></HTML> Fri, 14 Mar 2008 13:43:48 GMT https://community.cisco.com/t5/network-security/asa-vlan-subinterfaces/m-p/949038#M419895 Collin Clark 2008-03-14T13:43:48Z