ASA 5505 to 5506-X VLANs

[n-dominguez]

I just purchased an ASA 5506-X to replace our 5505. I, of course, want the 5506 to perform the same functions as the 5505. The 5505 is acting as a "router on a stick" for us for inter-vlan communications. We have 3 interfaces, outside(1 VLAN), inside(8 VLANS), and operations(3 VLANS). I tried to create the VLANs on the 5506 using the "interface VLAN <xxx>" command, but it doesn't exist. Instead, it looks like I'm supposed to use some sort of sub-interface syntax ("interface gigabitethernet 1/1.xxx"), but I'm getting confused now. With the 5505 the VLAN setup was independent of the interface, then you could just allow the VLAN on an interface using the "allowed vlan" command. But now it looks like I have to set it up as a sub interface. Can anybody help with my confusion?

[benford01]

Maybe have a look into putting it into transparent mode. This will allow you to block on the same network but you would have to make sure they are at either interface. Personally I have never set this up but I have seen it implemented.

[n-dominguez]

I'm a little more confused. This is from the 5506-X documentation:

"You cannot assign the same VLAN to multiple subinterfaces. You cannot assign a VLAN to the physical interface."

So, is it not possible to have 2 interfaces with the same VLAN allowed on them?

[divanko]

The creation of Integrated Bridging and Routing is now available in release 9.7 and higher:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/release/notes/asarn97.html#id_28545

https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/5506X/5506x-quick-start.html

I hope this helps someone looking for the same feature the 5505 had to offer regarding the 5505 built in switch capabilities.