Showing results for 
Search instead for 
Did you mean: 

ASA 5506-X - Switchports?

Level 4
Level 4

Just got my hands on a new ASA 5506-X and immediately ran into an odd issue:


There are eight layer 3 ports that seemingly cannot be used as switch ports.

There is no bridge-group capability available either. (which, if present, could be used to resolve this issue)


Why does this device even have 8 ports if they cannot be used as switchports?

Is this going to be fixed in future software? (By adding bridge groups?)

Can anyone think of any other "clever" workarounds?


Between this issue and the lack of POE, this device seems to be significantly less useful than the ASA5505.


Thank you.

92 Replies 92

Vlan configuration is pretty simple at both sides for me. I confused about Etherchannel configuration on ESXi 5.5 side. I tried various configurations but still can't make work links between ASA and ESXi as desired: both servers must have connection to ASA at the same time through VLAN Trunked link.
Even the one etherchannel link (with first server) is in ready state traffic still not working. I can't understand why.

We're looking at a RV345P-K9-NA.  8 POE and can do VPN and has16 total ports.

interesting thread, that doesn't seem to die. I worked at ASA shops, then went to PaloAlto shops. and now back at an ASA shop. the lack of switching in 5506-x is new to me, since I haven't worked with them in the past 4 years. I will reiterate that Cisco ASA team has officially, for years, been on a downward spiral. I almost crapped my pants when I found out that there was no switchport on the 5506-x, especially since there are 8 freaking ports on the dam thing. So i will change my comment to ASA team is has officially gone "stupid," or whatever the hell you want to say. First off, why 8 dam ports on a SOHO device - unless you make them a switch? Nobody is going to have 6+ routed subnets in a SOHO deployment? So I would almost give Cisco a "F", but for a good college try. but why not build the dam thing with 3-4 ports then - if they are going to be only routed?


So you are now officially stupid as a team, and didn't even try. It almost like someone opted to make a rube-goldberg type of ASA firewall just for the **bleep**s/giggles. Only, it actually got productized?!?!?! I guess that's what too much money does to a company. Anyway, this trend is disheartening. I was around for the ACE load-balancer, which was a fine device, until Cisco killed it off.


And i have seen the downward spiral of the switch platform as Cisco tries to push overly complicated SD networking, and diminish the 2960 line. And Cisco phone systems have become an untamed outlandishly complicated beast. So man, I would start dumping Cisco stock ASAP. Look at Ubiquiti, Palo Alto, A10, Citrix, F5, Digium, Shoretel, HP, Aruba.


BTW... i played around with the BVI interface thing on the ASA 5506x, and its equally stupid. Here are some issues:

1. the BVI interface doesn't accept ACL's like a regular interface (making it not like a VLAN)

2. to manage the ASA from the inside G1/X ports, you need to configure ssh/http management command for each G1/x port. this should normally go on the Vlan=BVI interface only, as the G1/x ports are bound to that broadcast domain. Very strange.

3. In ASDM, the Inside interface shows "down", even though its up and attached to BVI interface. Whats up with that?!?!?

4. The general config bloat and unnecessary nat/acl commands required at each G1/X interface suggest something is really wrong.

5. im seeing some strange ICMP connection loss error message, probably related to the crappy BVI implementation. I shodul say that I cannot ACL my way out of the error with a very liberal allow rule, so there has to be some sort of ASIC hardware **bleep** going on under the covers that i cannot fathom.


So WTF cisco! From "firepower" to "firesale"! activate your wonder twin powers quickly!

Review Cisco Networking for a $25 gift card