Need help converting ASA 5505 config to ASA 5512

Question

We recently upsized our internet speed and purchased an ASA 5512 to be able to take advantage of that, as the 5505 was capped at 100mbps. So here's my issue. I'm trying to create the VLANs on the new firewall but I can't seem to assign the same VLAN to multiple ports.

Example from old ASA 5505 configuration:

interface Vlan300
 nameif DMZ
 security-level 50
 ip address 192.168.5.5 255.255.255.0 
!
interface Vlan400
 nameif INSIDE
 security-level 90
 ip address 192.168.1.5 255.255.255.0

interface Ethernet0/3
 switchport access vlan 300
!
interface Ethernet0/4
 switchport access vlan 300
!
interface Ethernet0/5
!
interface Ethernet0/6
 switchport access vlan 400
!
interface Ethernet0/7
 switchport access vlan 400

On the new firewall I have to create a subinterface for the VLAN, so the VLAN is setup on a physical interface, and it does not allow me to make the same VLAN on a different port. Does anyone know of a way to assign a VLAN from one port to another?

Answer 1

The 5505 has a single switch connecting it to the world. So you configure VLANs and assign ports to each vlan (inside, outside, dmz.) The 5510+ have multiple routed interfaces. So you setup individual interfaces (Ethernet0, etc.) for "inside", "outside", etc. While you can configure VLANs behind an interface, I doubt that's what you need.

(For example, I have 3 "outside" VLANs. One per ISP.)

Answer 2

The answer is simply "no". As Ricky already told, the 5505 has an integrated switch built-in, hence you can create VLAN interfaces (which are then routed interfaces actually visible to the firewall). The larger ASA devices (honestly, I think all other Cisco firewalls except for the your old 5505) do not have such a switch built-in.

While you can configure sub-interfaces and use different VLANs on the same port (802.1q trunking), you cannot assign one VLAN on multiple ports. This is what a switch does, but the ASA cannot do that.

For a more detailed advice we would need more details about your network, such as why you need to have multiple ports with the same VLAN and what is connected to which interface. From what I see in your configuration, it seems that you simply connect multiple clients to the firewall. If this is the case: use any VLAN capable switch, connect it to your new ASA (either via one physical interface using 802.1q or multiple physical interfaces) and let both your ASA and the switch do what they were designed for.

Answer 3

To add to the answers you already have... The ports on the 5505 are Layer 2, meaning you assign VLANs to them and assign the IP addresses to the VLANs. Many people have this complaint related to the 5505 upgraded to 5506, which is a similar situation that you are in. They are layer 3 ports. You assign the addresses directly to the ports, and you cannot have multiple ports on the same subnet like before. This is in addition to the loss of the two POE ports. Your only solution is to have a smart switch that can handle multiple VLANs or multiple dumb switches, one for each of your subnets, plugged into different configured ports.
You must add additional hardware (assuming you don't have switches in the picture, since you didn't mention them) for you to maintain the same functionality and enjoy the larger speed.