Using 5506-x ASA as switch

[jam3]

I would like to configure my 5506-x with port 1 as outside and ports 2-8 inside on the same LAN (same security levels for all) with the ASA acting as the DHCP. I'm not sure what this would be called. Can anyone port me to a relevant guide or documentation?

[Mohammed al Baqari]

I don't think this possible in ASA. You can group interfaces in bridge
group to be in the same VLAN but then the ASA will be in transparent mode
and won't allow for routing within the unit.

[Sheraz.Salim]

Just to add what @Mohammed al Baqari said, if you have a base lic than it will be 5 VLAN limitation. and if you still want to go ahead than use version 9.7 to upwards as in 5506-X support the bridge group from 9.7.

[jam3]

5 is ok. How do I do it?

[Sheraz.Salim]

5 vlan come as default.

as an example.

[jam3]

ok, so how do I setup ports 2-6 as a VLAN?

[balaji.bandi · Accepted solution]

Example bridge group config - change as per your setup.

interface GigabitEthernet1/3
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif LAN
security-level 100
!

interface BVI1
nameif DMZ
nameif LAN
security-level 100

[Sheraz.Salim]

@balaji.bandi

interface BVI1
nameif DMZ
nameif LAN
security-level 100

!

thats wrong you cant have two nameif in one BVI?

[balaji.bandi]

typo correction :

interface BVI1
nameif LAN
security-level 100

[Sheraz.Salim]

interface GigabitEthernet1/0
 nameif Outside
 security-level 0
 ip address dhcp setroute
!
interface GigabitEthernet1/3
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif LAN
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif LAN
security-level 100
!
interface BVI1
nameif LAN
security-level 100
!
object network LAN
 subnet 192.168.1.0 255.255.255.0
 nat (LAN,Outside) dynamic interface
!

Let me know if you have any issues with setting up. I am here to help you.

[sp7412]

Does this work for 9.6?

[Sheraz.Salim]

no its from 9.7 onwards

[sp7412]

How do I update from 9.6 to 9.7?

[Sheraz.Salim]

you need a service contract with cisco in order to download the software here is the link

https://software.cisco.com/download/home/286283326/type/280775065/release/9.6.4%20Interim?catid=268438162

and here is the process how to upgrade it

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/200142-ASA-9-x-Upgrade-a-Software-Image-using.html

[sp7412]

I didn't get the service contract. I just bought the asa last month.