Cisco ASA 55XX Transparent mode VLAN traversing

[fuhrersk8]

Hello Cisco Forum Team!

    In a scenario where the Cisco ASA is in Transparent mode, is it possible to transmit L2 traffic from other VLANs different than the native VLAN the management IP of the firewall resides?

The switches on the outside and inside interfaces of the ASA are in trunk mode and I am trying to pass L2 VLAN ttraffic from inside to outside and vice-versa using filters on the switches (switchport trunk allowed vlan). 

Thanks in advanced for your support and comments!

[Marius Gunnerud · Accepted solution]

Yes it is possible but you will be limited to 8 VLANs, or more accurately, 8 BVI interfaces so this is not a scalable solution.  The catch is that you will need to have different VLANs for the same subnet at either end of the ASA. 

To clarify this, lets say you are using interface Gig0/1 and Gig0/2.  On Gig0/1 you would have configured subinterfaces with VLANs 2, 3, and 4.  Now if you try to configure these same VLANs on Gig0/2 you will get an error saying something like this VLAN is already configured on another interface...I don't remember the exact error. 

So to get this working you would need to configure Gig0/2 with subinterfaces for VLANs...lets say...5, 6, and 7.  you would then associate VLANs 2 and 5 with BVI 1, VLANs 3 and 6 with BVI 2, and VLANs 4 and 7 with BVI 3.  Each BVI interface would have its own IP address for the subnet that is being bridged across the ASA.

--

Please remember to select a correct answer and rate helpful posts

[fuhrersk8]

   Excellent. Thanks a lot for the great information!

   In my case, since I have same VLAN ID's already configured on the switches (inside and outside), this approach would not work. 

Thanks again for your great support!

[Marius Gunnerud]

Thank you for the rating :)

In my case, since I have same VLAN ID's already configured on the switches (inside and outside), this approach would not work.

This would really depend on how the rest of your network is set up and how dependent you are on those VLANs in the setup.  If you are going to implement a transparent firewall for multiple VLANs it would require some careful planning and preparation.

--

Please remember to select a correct answer and rate helpful posts