Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation

Question

I am in the middle of a project to migrate some existing switched ethernet dot1q trunks behind an ASA firewall... these trunks have five vlans each (numbered 51 - 55). This is a simple drawing of the original layer2 service...

VLAN_Translation_00

One of the requirements is to have an ASA firewall context per Vlan in the original dot1q trunk. This means I wind up using a BVI to bridge the new INSIDE interface to the DMZ interface in each FW context. Due to other constraints, I wind up with a FW config like this (I am summarizing out all the context stuff to simplify the question)...

firewall transparent
!
interface GigabitEthernet0/1.51
 vlan 51
 nameif INSIDE
 security-level 100
 bridge-group 1
!
interface GigabitEthernet0/2.951
 vlan 951
 nameif DMZ
 security-level 50
 bridge-group 1
!
interface BVI1
 ip address 10.10.51.240 255.255.255.0 standby 10.10.51.241
!

Cisco ASAs in transparent mode wind up using two different vlan IDs to connect a single layer2 vlan service. Connect the two vlans through interface BVI1; the bridge-group 1 configuration on each physical interface makes the connection between Vlan51 and Vlan951 in the config above.

Assume ASA:Gi0/2 connects to 4507:Gi1/2... Notice what happens to the DMZ interface... the ASA DMZ Vlan is 951, and this connects via a dot1q trunk to the DMZ switch (the Cat4507). I need to connect D1 to switchport 4507:Gi1/1, but I must deliver the Vlan951-955 services to D1 as dot1q Vlan51-55 on 4507:Gi1/1. In other words, the Vlan BVI wrangling I had to do on the ASA messes up the Vlan numbering in my original service definition.

VLAN_translation_01

Sadly, I cannot easily renumber the Vlans on D1. The perfect solution would be to somehow translate Vlan951 on 4507:Gi1/2 to Vlan51 on 4507:Gi1/1. Cisco has a feature called vlan mapping, but it seems to require QinQ... all my services are simple dot1q... the 4500 vlan mapping docs are not clear about how they handle simple dot1q encapsulation.

I know I can translate the vlans in the 4500 via loopback cable, but this burns two extra ports per Vlan... a total of ten extra ports for all the Vlans in the service (v51 - v55).

Question

Refer to the diagram below.

VLAN_translation_01

How can I translate all Vlans numbered 95x on the 4507:Gi1/2 dot1q trunk to be numbered Vlan5x on 4507:Gi1/1 dot1q? I need to use the fewest number of ports consumed for "translation overhead". Please include configs for all ports that your answer requires.

I am open to vlan mapping, if someone can explain how it would work in this topology...

Equipment

4507R+E, Sup7L-E with IOS XE 3.4.0
ASA5555X with 9.0(2)

Mike Pennington · Accepted Answer · 2013-07-09 11:55:12Z

I don't have SUP7 to test, but it works on SUP6 and SUP32, I would presume SUP7 retains this functionality.

I've tested between JNPR M320 <-> SUP32, and 'vlan mapping JNPR SUP32' works just fine.

There is no need for QinQ, what the QinQ option does is it adds top tag to one particularly tag. So switchport vlan mapping 1042 dot1q-tunnel 42 would map incoming [1042] stack to [42 1042] stack. As opposed to switchport vlan mapping 1042 42 which maps incoming dot1q Vlan [1042] to dot1q Vlan [42].

JNPR M320 config:

{master}[edit interfaces ge-0/1/0 unit 1042]
user@m320# show 
vlan-id 1042;
family inet {
    address 10.42.42.1/24;
}
{master}[edit interfaces ge-0/1/0 unit 1042]
user@m320# run show interfaces ge-0/1/0               
Physical interface: ge-0/1/0, Enabled, Physical link is Up
  Interface index: 135, SNMP ifIndex: 506
  Description: B: SUP32 ge5/1
  Link-level type: Flexible-Ethernet, MTU: 9192, Speed: 1000mbps, BPDU Error: None,
  MAC-REWRITE Error: None, Loopback: Disabled, Source filtering: Disabled, Flow control: Disabled,
  Auto-negotiation: Enabled, Remote fault: Online
  Device flags   : Present Running
  Interface flags: SNMP-Traps Internal: 0x4000
  CoS queues     : 8 supported, 8 maximum usable queues
  Current address: 00:12:1e:d5:90:7f, Hardware address: 00:12:1e:d5:90:7f
  Last flapped   : 2013-02-19 09:14:29 UTC (19w6d 21:12 ago)
  Input rate     : 4560 bps (5 pps)
  Output rate    : 6968 bps (4 pps)
  Active alarms  : None
  Active defects : None
  Interface transmit statistics: Disabled

SUP32 config:

SUP32#show run int giga5/1
Building configuration...

Current configuration : 365 bytes
!
interface GigabitEthernet5/1
 description F: M320 ge-0/1/0
 switchport
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 switchport vlan mapping enable
 switchport vlan mapping 1042 42
 mtu 9216
 bandwidth 1000000
 speed nonegotiate
 no cdp enable
 spanning-tree portfast edge trunk
 spanning-tree bpdufilter enable
end

SUP32#show ru int vlan42
Building configuration...

Current configuration : 61 bytes
!
interface Vlan42
 ip address 10.42.42.2 255.255.255.0
end

SUP32#sh int GigabitEthernet5/1 vlan mapping  
State: enabled
Original VLAN Translated VLAN
------------- ---------------
  1042           42  

SUP32#sh int vlan42                           
Vlan42 is up, line protocol is up 
  Hardware is EtherSVI, address is 0005.ddee.6000 (bia 0005.ddee.6000)
  Internet address is 10.42.42.2/24
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, 
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive not supported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:09, output 00:01:27, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
  L2 Switched: ucast: 17 pkt, 1920 bytes - mcast: 0 pkt, 0 bytes
  L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast
  L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes
     38 packets input, 3432 bytes, 0 no buffer
     Received 21 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles 
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     26 packets output, 2420 bytes, 0 underruns
     0 output errors, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

And

SUP32#ping 10.42.42.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.42.42.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
SUP32#sh arp | i 10.42.42.1
Internet  10.42.42.1             12   0012.1ed5.907f  ARPA   Vlan42
SUP32#show mac address-table dynamic address 0012.1ed5.907f
Legend: * - primary entry
        age - seconds since last seen
        n/a - not available

  vlan   mac address     type    learn     age              ports
------+----------------+--------+-----+----------+--------------------------
Active Supervisor:
*  450  0012.1ed5.907f   dynamic  Yes          0   Gi5/1
*   50  0012.1ed5.907f   dynamic  Yes          0   Gi5/1
*   40  0012.1ed5.907f   dynamic  Yes          0   Gi5/1
*   42  0012.1ed5.907f   dynamic  Yes          5   Gi5/1


user@m320# run ping 10.42.42.2 count 2 
PING 10.42.42.2 (10.42.42.2): 56 data bytes
64 bytes from 10.42.42.2: icmp_seq=0 ttl=255 time=0.495 ms
64 bytes from 10.42.42.2: icmp_seq=1 ttl=255 time=0.651 ms

--- 10.42.42.2 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.495/0.573/0.651/0.078 ms

{master}[edit interfaces ge-0/1/0 unit 1042]
user@m320# run show arp no-resolve |match 10.42.42.2 
00:05:dd:ee:60:00 10.42.42.2      ge-0/1/0.1042        none

Thanks for the example... So far, you're using an SVI to replace what I'm calling Gi1/1 in the original question; however, this would be a better answer if it proves that you don't need QinQ encap to share Vlan42 beyond the Sup32 itself. I will try it myself when I get to work if you don't answer sooner... — Mike Pennington, Jul 9, 2013 at 11:28
There is no QinQ at all involved. Imagine your FW is my M320 and your SUP7 is my SUP32. In your SUP7 FW port you just rewrite the FW VLAN to what it should be externally 'switchport vlan mapping <FW VLAN> <external VLAN>' — ytti, Jul 9, 2013 at 11:37
Cisco does VLAN mapping two ways. QinQ is used to preserve the original VLAN tag while traversing a "foreign" network such as a SP. One-to-One VLAN mapping, which is what is shown here, swaps dot1q tags, changing the VLAN ID when forwarding or receiving on the given interface. Both would work for question given. — Santino, Jul 9, 2013 at 11:55
QinQ application is mostly this CustL2 -- OperL2 -- CustL2, then in operL2 ports facing CustL2 you configure 'switchport mode dot1q-tunnel' and 'switchport access vlan 42'. And all CustL2 VLANs would transit OperL2 as '[ 42 X ]'. However at OperL2 all these share single MAC table, so it's not fully transparent, you can't have colliding X in VLANs in different Cust sites. MACinMAC (PBB) is more transparent solution with better scaling (MAC use in core). — ytti, Jul 9, 2013 at 12:16
FYI, it looks like switchport vlan mapping enable is not required on Sup7... — Mike Pennington, Jul 9, 2013 at 14:48

smoothbSE · Accepted Answer · 2013-07-09 17:03:51Z

some support for @ytti 's answer above, hope it helps:

orange#sh ver
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.04.00.SG RELEASE SOFTWARE (fc3)
…
orange#sh mod
Chassis Type : WS-C4507R+E

Mod Ports Card Type                              Model              Serial No.
---+-----+--------------------------------------+------------------+-----------
 4     4  Sup 7-E 10GE (SFP+), 1000BaseX (SFP)   WS-X45-SUP7-E      CAT1xxxxxxx 
…
orange#sh run int ten4/1
Building configuration...

Current configuration : 112 bytes
!
interface TenGigabitEthernet4/1
 switchport mode trunk
 switchport vlan mapping 100 10
 load-interval 30
end

orange#sh run int ten4/2
!
interface TenGigabitEthernet4/2
 switchport mode trunk
 switchport vlan mapping 10 100
 load-interval 30
…
orange#sh vlan mapping 
Interface Te4/1:
VLANs on wire                    Translated VLAN     Operation
------------------------------   ---------------     --------------
100                                   10             1-to-1
Interface Te4/2:
VLANs on wire                    Translated VLAN     Operation
------------------------------   ---------------     --------------
10                                    100            1-to-1

mellowd · Accepted Answer · 2013-07-09 07:02:10Z

3

I too do not have that SUP available, but can easily do this on a Brocade Netiron.

Simply put two ports in a VPLS and tag them with different vlans. Like so:

router mpls

    vpls translate test 100
     vlan 200
     tagged ethe 1/1
     vlan 300
     tagged eth1/2

Nice thing about the Brocade is that you can convert any tag to another tag, double-tag to another double-tag, double-tag to single-tag, and single-tag to double-tag

answered Jul 9, 2013 at 7:02

mellowd

3,82419 silver badges24 bronze badges

I have to use Supervisor7 in a c4507R+E for this service.
– Mike Pennington
Jul 9, 2013 at 11:15
As I understand it this technically isn't translation - it's defining two endpoints for that VPLS instance. Defining multiple tagged endpoints like this in a single VPLS instance is really just mashing all of the tagged traffic together. Translation would be one VPLS instance on one node, with the endpoint being a tagged VLAN + interface, and then that same VPLS instance on another node with an endpoint being a different tagged VLAN + interface.
– John Jensen
Jul 10, 2013 at 1:08
Also adding that if you did want to do translation on one device, you'd need to use a vll-local instead of a VPLS instance.
– John Jensen
Jul 10, 2013 at 4:24
No this VPLS will work. The Brocade won't allow you to use vll-local and use a lot of flexibility on double/single tagged frames. And yes, while 'technically' this isn't a translation, that's exactly what it will do. i.e. in the example above a frame with a vlan tag of 200 coming into eth1/1 will exit out of eth1/2 with a vlan tag of 300. So the end result is what the OP wants - It will not, of course, adjust any bpdu frames
– mellowd
Jul 10, 2013 at 6:48

Add a comment |

Stack Exchange Network

Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation

Question

Equipment

3 Answers 3

Your Answer

Not the answer you're looking for? Browse other questions tagged
cisco
ethernet
cisco-catalyst
vlan
firewall
or ask your own question.

Linked

Hot Network Questions

Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation

Question

Equipment

3 Answers 3

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged ciscoethernetcisco-catalystvlanfirewall or ask your own question.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
cisco
ethernet
cisco-catalyst
vlan
firewall
or ask your own question.