2

I have a Cisco ASA 5505 with a Security Plus license. I'm trying to have two physical ports provide two separate VLAN connections to the same physical network.

I have both VLANs defined properly - named "inside" and "test". I have the test VLAN assigned to Ethernet0/1. The goal is to have a completely segregated "test" network that cannot communicate with the inside network even if the proper subnet is applied to the NICs.

It works, somewhat, but I'm definitely missing something. When I have the cable plugged into e0/1 connecting it to my switch I get heavy and random packetloss from traffic over both VLANs - but traffic does flow to/from the Internet over both VLANs. When unplugging the cable traffic on the inside interface reverts to its rock-solid state.

Any direction would be greatly appreciated.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 9 '17 at 2:45
3

I'm trying to have two physical ports provide two separate VLAN connections to the same physical network.

I'm not sure I understand that sentence. It sounds a lot like "AP isolation" in wireless networks -- clients aren't allowed to talk to each other. That would be switchport protected on an ASA, but that's within a single VLAN. If the ports are in different VLANs, then they're routed based on security level, acls, nat, etc. (and you cannot have the same subnet on more than one active VLAN)

See Configuring Interfaces for the Cisco ASA 5505 Adaptive Security Appliance for more.

  • Thanks for the response and I'm sorry for not explaining myself clearly. I'm hoping to have a port dedicated to 172.16.1.0 network and another port dedicated to 10.1.1.0 network. Both networks connected/working over the same switch. Both networks utilizing the same ASA for Internet connectivity. Does that clear it up any better? – mark Sep 3 '14 at 13:40
  • Lots of people do that. You could do it with two sec-level 100 ("inside") interfaces. They cannot both be called "inside", tho. If you want the two networks to be able to communicate with each other, set same-security-traffic permit inter-interface – Ricky Beam Sep 3 '14 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.