07-07-2023 07:57 AM
Hi,
I have Cisco Firepower 1100 series (FPR-1120)
System image file is "disk0:/installables/switch/fxos-k8-fp1k-lfbff.2.8.1.105.SPA"
I am in a need to configure two or more LAN interfaces to make a LAN which can communicate at LAN level (in other words, in the same VLAN or same network).
I created a Ether channel as:
And let the DHCP (with all default values) to assign the IP addresses.
Now one of the member port is now connected with a network which is distributing IP addresses via DHCP.
When I connect a PC to second member port, it didn't get any IP from DHCP.
What should be configured to achieve a LAN based communication /switching so that I connect multiple devices belonging to the same network.
Note: I fully understand that Firepower is not designed for switching, and best solution should be to connect a LAN Switch in between to attach multiple clients. But sometimes, needs to find a solution outside of the recommended zone.
Any suggestion /step by step guide /screenshots will be appreciated.
Solved! Go to Solution.
07-10-2023 04:17 AM
step to config DHCP server in ASA via ASDM
07-10-2023 04:27 AM
you need assign IP to BVI
I believe I am doing it correct i.e. assign static IP address to BVI interface.
you need to enable DHCP server in this interface to make endpoint get IP from ASA BVI. >> If static IP address is assigned, how I can enable DHCP server?
07-10-2023 06:13 AM - edited 07-10-2023 06:15 AM
@MHM Cisco World Thanks for reply.
Now have enabled DHCP on BVI interface as:
Connected a client and still I didn't get IP from DHCP scope, but APIPA 169.x.x.x
07-10-2023 06:28 AM
FPR
endpoint1 connect to Eth1 (for example)
endpoint2 connect to Eth2 (for example)
go to interface Eth1 and Eth2 and add it to group 1
and config name for each interface (as you want).
07-10-2023 07:26 AM
@MHM Cisco World Thanks for supportive reply.
Can you have a look on the following (step-by-step) procedure? I am still getting 169.x.x.x on the end points side.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
FW3# sh ip address |
07-10-2023 07:30 AM - edited 07-10-2023 07:31 AM
all OK, just add nameif & secuirty level (must be 100) of port connect to endpoint
07-10-2023 07:45 AM
@MHM Cisco World
Security level is configured same as for the inside interface i.e. 100 ... or it should be something different?
Regarding the name, you mean Eth3 and Eth4 should be named differently? I tried to have same as BVI7, but that wasn't allowed.
07-10-2023 07:50 AM
security level must same for endpoints ports and BVI
name must be different like BVI7_1 and BVI7_2
07-10-2023 08:00 AM - edited 07-10-2023 08:02 AM
07-10-2023 08:16 AM
You are So So welcome
thanks for your words
have a nice day
MHM
07-10-2023 08:32 AM
Have a nice day you too @MHM Cisco World, your suggestion to use BVI instead of Ether channel saved the day, highly appreciated.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide