5

Background:

2 Cisco 2911 for two ISPs -> two physical ports on a Cisco 2960 switch -> a single port on ASA5520

I am running out of ports on a the ASA so I am thinking if i could do this the following way:


ON ASA

interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description ISP1
vlan 1
nameif OUTSIDE
ip address 202.X.X.100 255.255.255.0
!
interface GigabitEthernet0/1.11
description ISP2
vlan 11
nameif OUTSIDE11
ip address 102.X.X.100 255.255.255.0

ON SWITCH

interface GigabitEthernet1/0/1
description to ASA GE01
switchport trunk allowed vlan 1,11
switchport mode trunk
!
interface GigabitEthernet1/0/10
description ISP1
switchport mode access
switchport access vlan 1
!
interface GigabitEthernet1/0/20
description ISP2
switchport mode access
switchport access vlan 11
!
interface vlan 1
ip address 202.X.X.99 255.255.255.0
!
interface vlan 11
ip address 102.X.X.99 255.255.255.0
!

However, I am not able to ping each other after configuring the vlans and the subinterfaces.

Any comment would be appreciated.

Thanks,

Stephen

3
  • 4
    What exactly aren't you able to ping? Did you create vlans on switch? More details would be helpful. P.S.: it's not a good idea to use vlan 1.
    – ar_
    Apr 25, 2017 at 17:13
  • How do you have the security levels configured on the ASA? You might need to enable same–security-traffic permit inter-interface. Also, you didn't mention the version of ASA software you're using. Depending on that and your NAT config, you might need a NAT statement to allow traffic. Also, you might need to allow ICMP, either with inspection or an ACL. Really need more information from your ASA config and what it is you can't ping from and to (source/dest). I do agree that you probably have a native VLAN issue. An alternative solution to the one above is to just enable native VLAN tagging on t
    – Rooster
    Nov 16, 2017 at 7:43
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 19:15

2 Answers 2

1

You are likely experiencing a native VLAN issue on the switch. You are tagging VLAN 1 on the ASA, but the switch defaults to untagged for VLAN 1. You can do one of two things:

Option 1: Assign the nameif OUTSIDE and the IP address to the physical port Gi0/1 and get rid of your Gi0/1.1 definition (but leave the Gi0/1.11), like this:

interface GigabitEthernet0/1
 description ISP1
 nameif OUTSIDE
 ip address 202.X.X.100 255.255.255.0

interface GigabitEthernet0/1.11
 description ISP2
 vlan 11
 nameif OUTSIDE11
 ip address 102.X.X.100 255.255.255.0

Option 2: Change the native VLAN on the switch to something other than 1 or 11 (e.g., switchport trunk native vlan 1000)

0

It is very easy just remove ip address from the VLAN 1 And VLAN11 SVIs at switch and connect the accessed device with /24 respective ip address to switch than you can ping 202.X.X.100.

Explanation:- Vlan is just extension of Broadcast domain where it has an IP address like as 201.10.10.2/24 and all other devices can access any IP host that is downloaded in routing table with Gateway ip address 201.10.10.2.

1
  • "Vlan is just extension of collision domain" No. A VLAN is a broadcast domain, not a collision domain. Collision domains are bounded by layer-2 devices, and broadcast domains are bounded by layer-3 devices.
    – Ron Maupin
    Jun 15, 2018 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.