Hello,
If anyone out there with ASA 5505 Security Plus VLAN experience would help me out, I’d really appreciate it. I’m attempting to plan an implementation on a production 5505, but I don’t have the Security Plus license to try things out in a test lab setting, so I have no idea if these commands will work as intended until I get onsite and try them. I have not done a configuration like this one before, and I have not found a similar example.
This particular ASA is running 8.2(3) and ASDM 6.34-53. From what I have learned, because the 5505s have built-in switches and don’t provide subinterfaces, they are configured differently with regard to VLANs than higher level firewalls and routers and switches.
The new requirements for the 5505 (already in production) are to implement two Cisco 1142N Access Points in Autonomous Mode on the two ASA PoE ports. Each AP will have two SSIDs and two VLANs. One SSID/VLAN combination will only be allowed to access the ASA outside interface; the other combination will be allowed to access both the inside and outside ASA interfaces.
The AP configurations are identical other than a unique ip address. In other words, one SSID is for employees and the other is for the public. Wireless clients connecting to the APs will hopefully get their ip setup from the dhcp server on the ASA. Private addresses will be handed out to all wireless clients, including those with access to internal networks.
This approach relies on no-forward interface and access lists for security since, as I understand it, you need the same-security traffic to pass inter-interface. Access lists and NAT are not shown since I’m not that far along yet (just trying to validate the basics here). Since I don’t have a 5505 with a Security Plus license, all I can do is write out the commands as I would try them.
Thanks in advance for taking the time to look this over and comment.
VLAN Use
10 Native AP
20 Access Inside and Outside
30 Access Outside only
interface Vlan1
no forward interface Vlan30
nameif inside
security-level 100
ip address 192.168.75.253 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 75.x.x.x 255.255.255.252
interface Vlan10
nameif trunk
security-level 100
ip address 10.10.10.253 255.255.255.0
interface Vlan20
no forward interface Vlan30
nameif wired_pri
security-level 100
ip address 10.20.20.253 255.255.255.0
interface Vlan30
no forward interface Vlan1
no forward interface Vlan20
nameif wired_pub
security-level 100
ip address 10.30.30.253 255.255.255.0
interface Ethernet0/0
description *** Internet Connection ***
switchport access vlan 2
switchport access vlan 20
switchport access vlan 30
interface Ethernet0/1
description *** LAN Connection ***
switchport access vlan 1
switchport access vlan 20
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
description *** AP1 Connection ***
switchport mode trunk
switchport encapsulation dot1q
switchport access vlan 10
switchport trunk allowed vlan 20,30
interface Ethernet0/7
description *** AP2 Connection ***
switchport mode trunk
switchport encapsulation dot1q
switchport access vlan 10
switchport trunk allowed vlan 20,30
same-security-traffic permit inter-interface
dhcpd address 10.20.20.20-10.20.20.50 wired_pri
dhcpd dns 208.67.222.222 208.67.220.220 interface wired_pri
dhcpd domain 4-c.org interface wired_pri
dhcpd enable wired_pri
dhcpd address 10.30.30.30-10.30.30.50 wired_pub
dhcpd dns 208.67.222.222 208.67.220.220 interface wired_pub
dhcpd domain 4-c.org interface wired_pub
dhcpd enable wired_pub
