I have a Cisco ASA 5505 with a Security Plus license. I'm trying to have two physical ports provide two separate VLAN connections to the same physical network.

I have both VLANs defined properly - named "inside" and "test". I have the test VLAN assigned to Ethernet0/1. The goal is to have a completely segregated "test" network that cannot communicate with the inside network even if the proper subnet is applied to the NICs.

It works, somewhat, but I'm definitely missing something. When I have the cable plugged into e0/1 connecting it to my switch I get heavy and random packetloss from traffic over both VLANs - but traffic does flow to/from the Internet over both VLANs. When unplugging the cable traffic on the inside interface reverts to its rock-solid state.

Any direction would be greatly appreciated.

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 9, 2017 at 2:45

1 Answer 1


I'm trying to have two physical ports provide two separate VLAN connections to the same physical network.

I'm not sure I understand that sentence. It sounds a lot like "AP isolation" in wireless networks -- clients aren't allowed to talk to each other. That would be switchport protected on an ASA, but that's within a single VLAN. If the ports are in different VLANs, then they're routed based on security level, acls, nat, etc. (and you cannot have the same subnet on more than one active VLAN)

See Configuring Interfaces for the Cisco ASA 5505 Adaptive Security Appliance for more.

  • Thanks for the response and I'm sorry for not explaining myself clearly. I'm hoping to have a port dedicated to network and another port dedicated to network. Both networks connected/working over the same switch. Both networks utilizing the same ASA for Internet connectivity. Does that clear it up any better?
    – mark
    Sep 3, 2014 at 13:40
  • Lots of people do that. You could do it with two sec-level 100 ("inside") interfaces. They cannot both be called "inside", tho. If you want the two networks to be able to communicate with each other, set same-security-traffic permit inter-interface
    – Ricky
    Sep 3, 2014 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.