Showing results for 
Search instead for 
Did you mean: 

Confusing VLAN behavior

Here's the scenario:

  • Gi1/0/48 - uplink to ASA "inside" interface. It's configured as a trunk, allowed VLAN 1,200
  • Gi1/0/2 - connects to the ASA "outside" interface.  It's configured as an access port, on VLAN 2
  • Gi1/0/1 - uplink to a 3825 Router.  It's configured as an access port, on VLAN 2
  • VLAN1 - native VLAN on all devices (Everythings addressed broadly in
  • VLAN2 - not defined as an SVI or even a layer 2 vlan in the 3750 I've been describing (Gi1/0/1-2-48)
  • VLAN200 - voice vlan
  • Traffic moving from inside -> outside go through interface PAT on the ASA
  • Inside interface of ASA - has one sub-if for vlan 200
  • Outside interface has no sub-if's

I'm adding another ISP line upstream off of the 3825 for a Public-WIFI connection to some downstream WAP's, and to do that I've elected to place a new SVI on the 3750 (VLAN3, - issued by DHCP on the 3750), do identity NAT on the ASA from in->out for VLAN3 and use PBR on the router for the right gateway selection.

Yesterday.. I setup everything and was getting translate hits on the identity NAT.. so I knew stuff was making it out of the ASA.. but nothing was reaching the 3825 (I had an ACL logging hits to check this).. this got me to inspect the uplink types/info and I saw they were as access ports for vlan 2.. which was bizarre so I looked at the uplinks going INTO the ASA... and that's when I saw the trunk was only allowing vlan 1/200..

So my questions are:

  1. How did my VLAN 3 traffic get passed up this trunk to be translated on the ASA if the trunk only allows vlan 1,200
  2. How does daily traffic get out to the internet, if it's all VLAN 1 - the outside interface link to the 3750 is access vlan 2 and the outside interface on the ASA doesn't even have a sub-interface for vlan 2....?

Sorry for the length! Difficult to make this concise!

Very much looking forward to any thoughts.

Kindest Regards,


Content for Community-Ad