I am in the middle of a project to migrate some existing switched ethernet dot1q trunks behind an ASA firewall... these trunks have five vlans each (numbered 51 - 55). This is a simple drawing of the original layer2 service...
One of the requirements is to have an ASA firewall context per Vlan in the original dot1q trunk. This means I wind up using a BVI to bridge the new INSIDE interface to the DMZ interface in each FW context. Due to other constraints, I wind up with a FW config like this (I am summarizing out all the context stuff to simplify the question)...
firewall transparent ! interface GigabitEthernet0/1.51 vlan 51 nameif INSIDE security-level 100 bridge-group 1 ! interface GigabitEthernet0/2.951 vlan 951 nameif DMZ security-level 50 bridge-group 1 ! interface BVI1 ip address 10.10.51.240 255.255.255.0 standby 10.10.51.241 !
Cisco ASAs in transparent mode wind up using two different vlan IDs to connect a single layer2 vlan service. Connect the two vlans through
interface BVI1; the
bridge-group 1 configuration on each physical interface makes the connection between Vlan51 and Vlan951 in the config above.
Assume ASA:Gi0/2 connects to 4507:Gi1/2... Notice what happens to the DMZ interface... the ASA DMZ Vlan is 951, and this connects via a dot1q trunk to the DMZ switch (the Cat4507). I need to connect D1 to switchport 4507:Gi1/1, but I must deliver the Vlan951-955 services to D1 as dot1q Vlan51-55 on 4507:Gi1/1. In other words, the Vlan BVI wrangling I had to do on the ASA messes up the Vlan numbering in my original service definition.
Sadly, I cannot easily renumber the Vlans on D1. The perfect solution would be to somehow translate Vlan951 on 4507:Gi1/2 to Vlan51 on 4507:Gi1/1. Cisco has a feature called vlan mapping, but it seems to require QinQ... all my services are simple dot1q... the 4500 vlan mapping docs are not clear about how they handle simple dot1q encapsulation.
I know I can translate the vlans in the 4500 via loopback cable, but this burns two extra ports per Vlan... a total of ten extra ports for all the Vlans in the service (v51 - v55).
Refer to the diagram below.
How can I translate all Vlans numbered 95x on the 4507:Gi1/2 dot1q trunk to be numbered Vlan5x on 4507:Gi1/1 dot1q? I need to use the fewest number of ports consumed for "translation overhead". Please include configs for all ports that your answer requires.
I am open to vlan mapping, if someone can explain how it would work in this topology...
- 4507R+E, Sup7L-E with IOS XE 3.4.0
- ASA5555X with 9.0(2)