topic Re: ASA 5505 trunk in Network Security

ASA 5505 trunk

markedavis — Mon, 11 Mar 2019 22:01:28 GMT

Hi All,

I have an issue that's giving me fits. I have an ASA 5505 that I'm trying to set up a guest network on. I've configured an interface as a trunk and allowed the 2 vlans but I'm not getting any layer 3 to it. The switch connected to it is a 3560 and port is configured as a trunk with the same vlans.

I can't ping the ASA inside interface but I see its MAC address in the swtich's table.

I've got to be missing something.

Licensed features for this platform:

Maximum Physical Interfaces : 8

VLANs : 20, DMZ Unrestricted

Inside Hosts : Unlimited

Failover : Active/Standby

VPN-DES : Enabled

VPN-3DES-AES : Enabled

VPN Peers : 25

WebVPN Peers : 2

Dual ISPs : Enabled

VLAN Trunk Ports : 8

This platform has an ASA 5505 Security Plus license.

Config

ASA Version 7.2(3)

hostname ARLASA01

names

interface Vlan1

nameif inside

security-level 100

ip address 172.29.60.220 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address x.x.x.x 255.255.255.248

interface Vlan198

nameif guest

security-level 50

ip address 192.168.60.220 255.255.255.0

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

switchport trunk allowed vlan 1,198

switchport mode trunk

speed 100

duplex full

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

interface Ethernet0/7

ftp mode passive

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu guest 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 172.29.60.0 255.255.255.0

route inside 172.27.0.0 255.255.0.0 172.29.60.222 1

route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

username comms password eiE0IOA.TSSAU935 encrypted

prompt hostname context

Cryptochecksum:551464bc59e861c2c347731b3b4479b7

Any help would be appreciated.

Re: ASA 5505 trunk

varrao — Tue, 13 Dec 2011 18:00:12 GMT

Hi Mark,

You are trying to pass a native vlan in the trunk port, which is not going to work, as the packets for a native vlan are passed as untagged packets.

CSCsj96350 -

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsj96350

Create another unused vlan to pass the traffic for the native vlan and then you would need to add the following config:

Lets say you create another vlan 10, then :

interface Vlan10

nameif inside

security-level 100

ip address 172.29.60.220 255.255.255.0

interface Ethernet0/1

switchport trunk allowed vlan 10,198

switchport mode trunk

switchport trunk native vlan 1

speed 100

duplex full

and it should work after this.

Hope that helps.

Thanks,

Varun

Re: ASA 5505 trunk

markedavis — Tue, 13 Dec 2011 18:26:11 GMT

Hi Varun,

Thanks for the reply. I was afraid of something like that. I see that

there isn't a native vlan command in this IOS though the documentation says

there is.

So if I do this I would need to place all the users currently on vlan 1

onto vlan 10, correct?

Regards,

Mark Davis

Telecom Consultant

American Bureau of Shipping

281.877.6434

From: varrao

To: markedavis

Date: 12/13/2011 12:00 PM

Subject: - Re: ASA 5505 trunk

ASA 5505 trunk

varrao — Tue, 13 Dec 2011 18:29:14 GMT

Yes, thats correct. Let me know once you try this.

Thanks,

Varun

Re: ASA 5505 trunk

markedavis — Tue, 13 Dec 2011 18:31:11 GMT

Thanks, I'll have to wait as its at a remote office and I'll need to do it

during the off hours.

Regards,

Mark Davis

Telecom Consultant

American Bureau of Shipping

281.877.6434

From: varrao

To: markedavis

Date: 12/13/2011 12:29 PM

Subject: - Re: ASA 5505 trunk