Gi1/0/48 - uplink to ASA "inside" interface. It's configured as a trunk, allowed VLAN 1,200
Gi1/0/2 - connects to the ASA "outside" interface. It's configured as an access port, on VLAN 2
Gi1/0/1 - uplink to a 3825 Router. It's configured as an access port, on VLAN 2
VLAN1 - native VLAN on all devices (Everythings addressed broadly in 172.16.0.0/16
VLAN2 - not defined as an SVI or even a layer 2 vlan in the 3750 I've been describing (Gi1/0/1-2-48)
VLAN200 - voice vlan 10.2.100.0/24
Traffic moving from inside -> outside go through interface PAT on the ASA
Inside interface of ASA - has one sub-if for vlan 200
Outside interface has no sub-if's
I'm adding another ISP line upstream off of the 3825 for a Public-WIFI connection to some downstream WAP's, and to do that I've elected to place a new SVI on the 3750 (VLAN3, 192.168.1.0/24 - issued by DHCP on the 3750), do identity NAT on the ASA from in->out for VLAN3 and use PBR on the router for the right gateway selection.
Yesterday.. I setup everything and was getting translate hits on the identity NAT.. so I knew stuff was making it out of the ASA.. but nothing was reaching the 3825 (I had an ACL logging hits to check this).. this got me to inspect the uplink types/info and I saw they were as access ports for vlan 2.. which was bizarre so I looked at the uplinks going INTO the ASA... and that's when I saw the trunk was only allowing vlan 1/200..
So my questions are:
How did my VLAN 3 traffic get passed up this trunk to be translated on the ASA if the trunk only allows vlan 1,200
How does daily traffic get out to the internet, if it's all VLAN 1 - the outside interface link to the 3750 is access vlan 2 and the outside interface on the ASA doesn't even have a sub-interface for vlan 2....?
Sorry for the length! Difficult to make this concise!
I am trying to get the answer from the document below:http://www.cisco.com/c/en/us/products/collateral/switches/nexus-3000-series-switches/white_paper_c11-726674.pdf But, when I click on it, it didn't give me the document itself. Can someb...
(Pdf copy at the bottom)
Segmentation within SD-Access is enabled through the combined use of both Virtual Networks (VN), which are analogous to VRFs, and Cisco Scalable Group Tags (SGTs). VNs, like VRFs, provide comp...
The 2020 IT Blog Awards, hosted by Cisco, is now open for submissions through October 16. Submit your blog, vlog or podcast today. For more information, including category details, the process, past winners and FAQs, check out: https://www.cisco...
Hello,We have a pair of N3K-3064PQ-10GX and one of them acting as backup and we want to migrate from VyOS to it, we want to add 500x interface vlan and each interface vlan has its own ip/prefixes (for example /30 /29 ...) and we ahve 6-8x BGP session with...
We live in an age that is both thrilling and evolving substantially. A new trend/technology is always on rise even before the preceding has been used to its fullest potential. Although the concepts of digital transformation may seem over discussed, ...