topic Re: ASA Subinterfaces in Network Security

ASA Subinterfaces

networker99 — Mon, 11 Mar 2019 15:15:51 GMT

I am trying to configure sub interfaces on a Cisco ASA running v7.2 but it will not let me use the sub interface command?

Re: ASA Subinterfaces

massimiliano.serafino — Tue, 07 Apr 2009 13:24:17 GMT

Hi,

If you have an interface say it gigabit ethernet 0/1 in order to create a subinterface of gigabitethernet 0/1 you have to issue the command:

interface gigabitethernet 0/1.x where x is a number (say it 1..for example)...

I hope this help.s

Best regards.

Massimiliano.

Re: ASA Subinterfaces

andrew.prince — Tue, 07 Apr 2009 13:24:39 GMT

check your license - do you have a ASA5505 ?

Re: ASA Subinterfaces

andrew.prince — Tue, 07 Apr 2009 13:25:40 GMT

check your license - do you have a ASA5505 ?

Re: ASA Subinterfaces

networker99 — Tue, 07 Apr 2009 13:25:55 GMT

I tried that but I get the following

ciscoasa(config-if)# int ethernet0/0.100

ERROR: % Invalid input detected at '^' marker.

Re: ASA Subinterfaces

networker99 — Tue, 07 Apr 2009 13:27:28 GMT

Yes, which license should I have?

Re: ASA Subinterfaces

andrew.prince — Tue, 07 Apr 2009 13:38:16 GMT

To be above to trunk and use sub-interfaces you need "Security Plus" Which allows for 20 vlans and trunking support.

HTH>

Re: ASA Subinterfaces

networker99 — Tue, 07 Apr 2009 13:47:29 GMT

thanks

Re: ASA Subinterfaces

MarcinChameleon — Mon, 09 Jan 2012 21:13:42 GMT

I got similar problem.

My ASA says ethernet instead of Giga.

I def have Security Plus license, Check in "about" via ASDM.

Please help.

Marcin

Re: ASA Subinterfaces

varrao — Mon, 09 Jan 2012 21:25:19 GMT

Hi Marcin,

do you have the same ASA 5505???

Varun

Re: ASA Subinterfaces

varrao — Mon, 09 Jan 2012 21:27:58 GMT

Because ASA 5505 only have ethernet ports not gig ports.Here's the datasheet:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_data_sheet0900aecd802930c5.html

Varun

Re: ASA Subinterfaces

MarcinChameleon — Mon, 09 Jan 2012 21:29:38 GMT

Thanks, it is ASA 8.2

But I did that:

ciscoasa(config)# int e0/0

ciscoasa(config-if)# no nameif

ciscoasa(config-if)# no sec

ciscoasa(config-if)# no security-level

ciscoasa(config-if)# no ip ad

ciscoasa(config-if)# no ip address

and got this when trying to create subinterface:

ciscoasa(config)# int ethernet 0/0.1

ERROR: % Invalid input detected at '^' marker.

Any ideas?

Re: ASA Subinterfaces

andrew.prince — Mon, 09 Jan 2012 22:56:47 GMT

you create a vlan interface, then assign the physical interface to the vlan.

Int vlan x

Interface fa0/0

Switchport access vlan x

Sent from Cisco Technical Support iPad App

Re: ASA Subinterfaces

varrao — Mon, 09 Jan 2012 23:14:19 GMT

You cannot create sub-interfaces on the physical interface on the ASA 5505 but you would need to create vlan interfaces as specified above.

Thanks,

Varun

Re: ASA Subinterfaces

MarcinChameleon — Mon, 09 Jan 2012 23:52:03 GMT

I thought that with security plus license I can?

Basically I need outside interface to listen on more than 2 public IPs.

As outside interface is on /28 network.

If I create config as Andrew adicesed, will that work?

Marcin.

Re: ASA Subinterfaces

Julio Carvajal — Tue, 10 Jan 2012 01:00:32 GMT

Hello Marcin,

The thing with the ASA 5505 is that without the security plus license you will not be able to have more than 2 interfaces unrestricted. So that is why you need it.

Now that you have it you can create more vlans with the suggestions Andrew have provided you.

Seems like you want the ASA to have connectivity to the outside using 2 ip addreses on the same subnet, that will not be possible as each vlan interface got to be on a different broadcast domain. You can configure the ASA to proxy-arp more than 1 ip address on its outside interface by using static nat.

Also remember that the ASA does not support PBR.

Hope this helps.

Do rate helpful posts.

Julio

Re: ASA Subinterfaces

andrew.prince — Tue, 10 Jan 2012 08:00:37 GMT

You cannot have an ASA "listen" i.e have an interface configured with 2 ip addresses. You configure 1 ip address on the outside, and your ISP will "route" the other ip range to that IP and you can then assign the other IP range to another seperate interface, or as Julio has also pointed out.

HTH>

Re: ASA Subinterfaces

MarcinChameleon — Wed, 08 Feb 2012 10:49:56 GMT

Hi All,

I had to return the ASA 5505 because of lack of functionality I was looking for.

It’s pretty shame for cisco ASA 5505 and the money you pay for it, and then cannot do job as old Watchguard x1000 L

Thanks for all support.

Marcin.

See Cisco ASA 5500 - Sub

Peter Long — Sat, 18 Jul 2015 17:22:41 GMT

See Cisco ASA 5500 - Sub Interfaces and VLANS

Pete