Hi NetPros
I have two 5540 connected to a pair of 3750 stacked
I have established trunks with the pair of 5540s in active/standby and 3750 stacked switches
My configuration on ASAs is below
---------------------------------------------------------------------------------
interface GigabitEthernet0/2
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/2.1
vlan 2
nameif DMZ1
security-level 50
ip address 172.16.1.9 255.255.255.0 standby 172.16.1.10
!
interface GigabitEthernet0/2.2
vlan 4
nameif DMZ2
security-level 70
ip address 172.16.2.9 255.255.255.0 standby 172.16.2.10
-------------------------------------------------------------------------------------
i can ping from 172.16.1.9 to 172.16.1.10
also from 172.16.2.9 to 172.16.2.10
the firewalls can ping each other.
The switch has Private vlan config as below in order to not allow hosts communcation between them but they should be able to connect to the firewall vlan interfaces.
-----------------------------------------------------------------------------------
vlan 2
name DMZ-Promiscuous
private-vlan primary
private-vlan association 3
!
vlan 3
name DMZ-Isolated
private-vlan isolated
!
vlan 4
name OM-dmz-promiscuous
private-vlan primary
private-vlan association 5
!
vlan 5
name OM-dmz-Isolated
private-vlan isolated
Also... host ports are configured as below
interface GigabitEthernet1/0/4
description Host_in_DMZ1
switchport private-vlan host-association 2 3
switchport mode private-vlan host
switchport nonegotiate
spanning-tree portfast
spanning-tree bpduguard enable
end
interface GigabitEthernet1/0/22
description DMZ2
switchport private-vlan host-association 4 5
switchport mode private-vlan host
switchport nonegotiate
spanning-tree portfast
spanning-tree bpduguard enable
end
--------------------------------------------------------------------------------------------
Is the Trunk configuration on 3750 below correct or do I need to specify any other private-vlan configs like switch " switchport mode private-vlan promiscuous". But these are only for access ports not trunks.. Hosts cannot communicate with the firewall interfaces ..Can someone please help me..
----------------------------------------
interface GigabitEthernet1/0/43
description ASA1 DMZ1/DMZ2 TRUNK
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport trunk allowed vlan 2-5
interface GigabitEthernet2/0/43
description ASA2 DMZ1/DMZ2 TRUNK
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport trunk allowed vlan 2-5
----------------------------------------------------
Thanks
Fareed
