Hello,
I am using an ASA5510 configured with redundant interface pairs and multiple VLAN sub-interfaces, having different security levels.
The VLANs and sub-interfaces will need to pass traffic between subnets.
I have added the same-security-traffic permit intra-interface command as well as necessary static NATs / ACLs
From the ASA I will connect to core switches configured as trunk ports.
The primary ASA redundant interface will connect to Switch A and the secondary will connect to Switch B.
Below is a brief outline of some of the subnets configured and interfaces.
ASA
interface GigabitEthernet0/2
speed 1000
duplex full
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
speed 1000
duplex full
no nameif
no security-level
no ip address
interface Redundant1
description redundant interface group 1 members
member-interface GigabitEthernet0/2
member-interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Redundant1.5
vlan 5
nameif inside
security-level 100
ip address 192.168.10.1 255.255.255.0 standby 192.168.10.2
!
interface Redundant1.10
vlan 10
nameif lan1
security-level 99
ip address 192.168.11.1 255.255.255.0 standby 192.168.11.2
!
interface Redundant1.15
vlan 15
nameif lan2
security-level 50
ip address 192.168.12.1 255.255.255.0 standby 192.168.12.2
My question involves properly configuring the vlans on the switch trunk ports for tagged traffic.
For example, on Switch A gig0/5 will connect to gig0/2 on the ASA.
Switch A will need to accept and pass traffic from and bound for vlans 5, 10, 15.
An inside client on the network behind the core switch with an IP of 192.168.10.50 will need to
pass traffic to a LAN2 client with an IP of 192.168.12.50
Would the gig0/5 port on the Switch A simply need to be configured as a trunk port allowing vlan 5, 10, 15?
Switchport mode trunk
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 5, 10, 15
Are there any additional native vlan, trunking, tagging requirements on either the ASA or Switch?
Thank you.
