Creating VLANs on ASA5512 and transporting them to 2960S switch

[sharma.pulkit]

Hi,

One if my customer has a scenario wherein they want to configure the vlans on the ASA-5512 and pass the vlan traffic on the 2960S switches.

I have suggested them to configure the vlan interfaces on the ASA and create trunk ports on the 2960S with the vlan as native vlan.

Can you please suggest. if thats the correct way.

Thanks

Pulkit

[Jouni Forss]

Hi,

Well on the ASA firewalls side you configure a Trunk interface pretty much with the same idea that is done on the Cisco routers.

You configure subinterfaces for each Vlan. The only ASA model to my understanding that supports configuring actual Vlan interfaces on the firewall is the ASA5505 which has its own switch module. (Naturally there is FWSM and ASASM also)

The ASA interface configuration looks something like this

interface GigabitEthernet0/0

description TRUNK

no nameif

no security-level

no ip address

interface GigabitEthernet0/0.100

vlan 100

description LAN

nameif LAN

security-level 100

ip address 10.10.100.1 255.255.255.0

interface GigabitEthernet0/0.200

vlan 200

description DMZ

nameif DMZ

security-level 50

ip address 10.10.200.1 255.255.255.0

Ant the switch would naturally have their own Trunk configurations for the interface connected to the above ASA interface GigabitEthernet0/0

Hope this helps

- Jouni