Hi Adlai, Let me know the requirements and diagram, so i could explain the exfiguration to you. Thanks Saurabh ... View more

Hi Dave, Switching facility is available only in 5505 ASA Firewall and above thing can be possible by extending the connectivity to switch or change the firewall mode to transparent. Please rate every post. Thanks Saurabh Goel ... View more

HI Tom, please share the config , or topology so I can troubleshoot it further. Thanks ... View more

Hi Marek, we had created three separate SVI in switch for each VRF and correspondingly three subinterface on ASA firewall. the route the traffic towards VLAN and subinterfaces. Above soluting is working with static routing and OSPF also. if you need any help regarding this.. let me know. Thanks Saurabh Goel ... View more

Hi, Mac address of Firewall interface is not reflecting in switch mac-address table... Regards Saurabh Goel ... View more

This command is already in ASA... Regards ... View more

What does the meaning of  VRF assignment on 7k and 7K Switch port is trunk port so what does the problem in that? ------ Saurabh ... View more

Yes dot1 q between the ASA and 7k. Each VLAN is separetely terminated on ASA with subinterfaces. Q.    On N7k it's one physical interface (trunk) with multiple vlans - and each in separate VRF ? Ans Yes Q And we have a problems with pings between directly connected devices in the same vlan ? Ans Yes directly connnected device are not pinging. Firewall Interface configuration: interface Port-channel13 no vlan no nameif no security-level no ip address ! interface Port-channel 13.1021 description VRF-X vlan 1021 nameif inside security-level 100 ip address x.x.15.5 255.255.255.0 interface Port-channel13.1022   description VRF-Y vlan 1022 nameif inside security-level 100 ip address x.x.11.5 255.255.255.0 Switch Interface is Trunk port and all VLANS are allowed in that ... View more

Hi, ALL above things possible in ASA 1) You want to separte the Internet traffic and VPN traffic on firewall... That one is possible throught the CRYPTO ACL of Tunnel.., Please mention the ACL and Detination POOL which you want to access throough the Site to Site tunnel. This option is available in Cisco ASDM also. 2) Route SLA concept is available in Cisco.. if Primary default gateawy fails in your case..it will automatically divert your traffic to Secondary default gateway... 3) user Any connect.. in this case you dont need to bother about the cisco client and pcf file on user machine , it will be automatically configured through the URL access. 4) Thats your choice,,, you can use DMZ or OUTSIDE2 ,,everything depend on the securoty level of interface.. 5) you can use any pool thats upto you... do let me know if you have any query... Regards Saurabh Goel ... View more

Hi Andrey, Change the source port with any port greater than 1024 and test it... Otherwise share the ACL correponding to this traffic ... Regards Saurabh goel ... View more

Hi, We dont have router here... link type is ADSl... ... View more