topic Re: Using 5506-x ASA as switch in Network Security

Using 5506-x ASA as switch

jam3 — Fri, 21 Feb 2020 16:40:14 GMT

I would like to configure my 5506-x with port 1 as outside and ports 2-8 inside on the same LAN (same security levels for all) with the ASA acting as the DHCP. I'm not sure what this would be called. Can anyone port me to a relevant guide or documentation?

Re: Using 5506-x ASA as switch

Mohammed al Baqari — Wed, 16 Jan 2019 17:26:04 GMT

I don't think this possible in ASA. You can group interfaces in bridge
group to be in the same VLAN but then the ASA will be in transparent mode
and won't allow for routing within the unit.

Re: Using 5506-x ASA as switch

Sheraz.Salim — Wed, 16 Jan 2019 17:32:38 GMT

Just to add what @Mohammed al Baqari said, if you have a base lic than it will be 5 VLAN limitation. and if you still want to go ahead than use version 9.7 to upwards as in 5506-X support the bridge group from 9.7.

Re: Using 5506-x ASA as switch

jam3 — Wed, 16 Jan 2019 17:41:40 GMT

5 is ok. How do I do it?

Re: Using 5506-x ASA as switch

Sheraz.Salim — Wed, 16 Jan 2019 17:48:58 GMT

5 vlan come as default.

as an example.

Re: Using 5506-x ASA as switch

jam3 — Wed, 16 Jan 2019 18:26:25 GMT

ok, so how do I setup ports 2-6 as a VLAN?

Re: Using 5506-x ASA as switch

balaji.bandi — Wed, 16 Jan 2019 21:00:23 GMT

Example bridge group config - change as per your setup.

interface GigabitEthernet1/3
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif LAN
security-level 100
!

interface BVI1
nameif DMZ
nameif LAN
security-level 100

Re: Using 5506-x ASA as switch

Sheraz.Salim — Wed, 16 Jan 2019 21:30:29 GMT

interface GigabitEthernet1/0
nameif Outside
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/3
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif LAN
security-level 100
!
interface BVI1
nameif LAN
security-level 100
!
object network LAN
subnet 192.168.1.0 255.255.255.0
nat (LAN,Outside) dynamic interface
!

Let me know if you have any issues with setting up. I am here to help you.

Re: Using 5506-x ASA as switch

Sheraz.Salim — Wed, 16 Jan 2019 21:38:21 GMT

@balaji.bandi

interface BVI1
nameif DMZ
nameif LAN
security-level 100

thats wrong you cant have two nameif in one BVI?

Re: Using 5506-x ASA as switch

balaji.bandi — Thu, 17 Jan 2019 05:54:30 GMT

typo correction :

interface BVI1
nameif LAN
security-level 100

Re: Using 5506-x ASA as switch

sp7412 — Wed, 23 Jan 2019 22:14:18 GMT

Does this work for 9.6?

Re: Using 5506-x ASA as switch

Sheraz.Salim — Wed, 23 Jan 2019 22:32:24 GMT

no its from 9.7 onwards

Re: Using 5506-x ASA as switch

sp7412 — Wed, 23 Jan 2019 22:35:48 GMT

How do I update from 9.6 to 9.7?

Re: Using 5506-x ASA as switch

Sheraz.Salim — Wed, 23 Jan 2019 22:39:16 GMT

you need a service contract with cisco in order to download the software here is the link

https://software.cisco.com/download/home/286283326/type/280775065/release/9.6.4%20Interim?catid=268438162

and here is the process how to upgrade it

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/200142-ASA-9-x-Upgrade-a-Software-Image-using.html

Re: Using 5506-x ASA as switch

sp7412 — Wed, 23 Jan 2019 22:40:10 GMT

I didn't get the service contract. I just bought the asa last month.