topic Re: VLAN on ASA 5520 in Network Security

VLAN on ASA 5520

denaumcisco — Mon, 11 Mar 2019 14:51:14 GMT

Good afternoon guys,

I'd like to do a vlan with 2 interfaces and just one IP, can I do it?

Re: VLAN on ASA 5520

Jon Marshall — Mon, 16 Feb 2009 18:10:55 GMT

Denis

Could you give a few more details.

You can use transparent mode where you have 2 vlans with one IP but by the sounds of it this is not what you want.

Are you asking if the ASA can support IRB (Intergrated Routing/Bridging) where 2 interfaces on your ASA are in the same vlan and share an IP address ?

Jon

Re: VLAN on ASA 5520

denaumcisco — Mon, 16 Feb 2009 18:51:24 GMT

Yes Jon, something like IRB

Re: VLAN on ASA 5520

Jon Marshall — Mon, 16 Feb 2009 19:40:59 GMT

Denis

I'm not aware of the ASA supporting the likes of IRB but then i have never found the need to configure it so i'm not 100% certain on that. I have had a quick look at the configuration docs and couldn't find anything other than transparent mode which is slightly different ie. you bridge together 2 vlans.

Unfortunately i don't have access to an ASA to test but i don't think this is supported.

Jon

Re: VLAN on ASA 5520

denaumcisco — Mon, 16 Feb 2009 19:55:37 GMT

Well, I need to link 2 computers into the ASA using necessarily 2 ASA's interfaces.

and I need to put the same IP address on both interfaces, because the computers have the same configuration

Anybody?

Re: VLAN on ASA 5520

denaumcisco — Mon, 16 Feb 2009 20:33:26 GMT

I need to do a vpn between two ASA 5520 with the basic IOS, can I do it?

Re: VLAN on ASA 5520

robertson.michael — Tue, 17 Feb 2009 03:12:44 GMT

Hi Denis,

In response to your second question: yes, you can configure a basic VPN tunnel between two ASA's. Take a look at the following link for more details and configuration examples:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/ike.html

Hope that helps.

-Mike

Re: VLAN on ASA 5520

denaumcisco — Wed, 18 Feb 2009 23:03:06 GMT

Mike,

Do you have a configuration for me to do a vpn between 2 ASA 5520?

I tried use some commands from the guide that u sent to me , but without sucess

Re: VLAN on ASA 5520

denaumcisco — Thu, 19 Feb 2009 11:13:58 GMT

Anybody has a configuration for me to do a vpn between 2 ASA 5520?

I tried use some commands from the guide isakmp/ipsec , but without sucess

And a solution to a backup route, I found the command "track" on the internet, but didnt work on 5520

thanks

Re: VLAN on ASA 5520

denaumcisco — Thu, 19 Feb 2009 11:24:00 GMT

Here is the vpn configuration and the results

crypto isakmp policy 10 hash md5

crypto isakmp policy 10 authentication pre-share

crypto isakmp enable outside

crypto map mymap 10 match address 100

access-list 100 permit ip 172.16.3.0 255.255.255.0 172.16.1.0 255.255.255.0

crypto ipsec transform-set myset esp-des esp-hd5-hmac

crypto map mymap 10 set peer 10.22.12.22

crypto map mymap 10 set transform-set myset

crypto map mymap interface outside

Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)

Total IKE SA: 1

1 IKE Peer: 10.12.28.5

Type : user Role : initiator

Rekey : no State : MM_WAIT_MSG4

Re: VLAN on ASA 5520

robertson.michael — Thu, 12 Mar 2009 21:53:34 GMT

Hi Dennis,

Can you post the configurations on both sides of tunnel? Many of the settings much match. Here is an example that should at least bring the tunnel up:

ASA1:

crypto isakmp policy 10 hash md5

crypto isakmp policy 10 authentication pre-share

crypto isakmp policy 10 encryption des

crypto isakmp policy 10 group 2

crypto isakmp policy 10 lifetime 86400

crypto isakmp enable outside

crypto map mymap 10 match address 100

access-list 100 permit ip 172.16.3.0 255.255.255.0 172.16.1.0 255.255.255.0

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto map mymap 10 set peer 10.22.12.22

crypto map mymap 10 set transform-set myset

crypto map mymap 10 set pfs

crypto map mymap interface outside

ASA2:

crypto isakmp policy 10 hash md5

crypto isakmp policy 10 authentication pre-share

crypto isakmp policy 10 encryption des

crypto isakmp policy 10 group 2

crypto isakmp policy 10 lifetime 86400

crypto isakmp enable outside

crypto map mymap 10 match address 100

access-list 100 permit ip 172.16.1.0 255.255.255.0 172.16.3.0 255.255.255.0

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto map mymap 10 set peer 10.22.12.21

crypto map mymap 10 set transform-set myset

crypto map mymap 10 set pfs

crypto map mymap interface outside

As I mentioned, if you are still having trouble, please post your existing configs that exist on each side of the tunnel.

Hope that helps.

-Mike