1

I’m really struck with configuring VLAN and route, I hope you can help.

  • 1 ASA5512 Firewall
  • 1 CISCO SG500x Layer 3 switch (Core Switch)
  • 3 CISCO SG200-50p switch (web management access only) (Access Switch)

I have created 6 VLANS on the firewall and have assigned IP Address to it accordingly, on the core switch I have created 6 VLANS with the same VLAN ID as firewall and assigned ports to it (Ie interface range gi1/1 – 3, VLAN x, etc) In the core switch I have assigned 3 ports per vlan as they will be trunk ports (I hope this is correct).

What port do I need to assign IP Address to? Also for the three access switch do I create one trunk port for each and all other ports are to be access ports?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:14
  • is this also applicable to ASA5506X? Thanks, Masood – Masood Oct 6 '17 at 15:37
2
interface Ethernet0/0
 no shutdown
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/0.48
 vlan 48
 nameif vlan48
 security-level 100
 ip address 192.168.48.1 255.255.255.192 
!
interface Ethernet0/0.101
 vlan 101     
 nameif vlan101
 security-level 100
 ip address 192.168.48.66 255.255.255.224 
....

The ASA port (e0/0 in this example) would go to a trunk port set to allow all the vlans configured on the ASA (48 and 101, here) The ASA is then the router between those VLANs. Any address assigned to the switches would be purely for management. And they would assigned to a VLAN, not a port.

The topology between devices is, indeed, all trunks. (because you want all vlans to be available everywhere.) The access ports -- ports where individual machines are connected -- would be assigned to only one VLAN.

| improve this answer | |
  • Thanks Ricky for your advice, so according to your example do I need to create those two VLANS (48 and 101) on the switch as well? and if so do they need to have the same VLAN ID as the ASA ie - Vlan 48 and Vlan 101? – Senthu Feb 3 '15 at 2:29
  • If the ASA is doing inter-vlan routing, then it will have to have vlan interfaces configured, and the switch trunk port must be configured with the same vlans. – Ricky Beam Feb 3 '15 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.