2

I created subinterface on Cisco ASA 5550 (ver. 9.7.1):

interface GigabitEthernet1/2.810
 vlan 810
 nameif dmz810
 security-level 50
 ip address 172.29.12.33 255.255.255.248

And VLAN 810 on HP ProCurve E5406zl (J8697A):

vlan 810
   name "DMZ810"
   tagged B2,B23-B24
   no ip address
   exit

VLANs are transmitted by GVRP, so we do not need to register them manually on each interface. I don't rigistered VLAN 810 (and many another DMZ) on ASA-HP links. Other networks work, but not VLAN 810. Tagged interfaces on switch - links to another switches.

For verification I assigned on VLAN 810 IP-address:

vlan 810
       name "DMZ810"
       tagged B2,B23-B24
       ip address 172.29.12.37 255.255.255.248
       exit

Bun they don't ping in both directions.

For example, this is a working subinterface and VLAN:

interface GigabitEthernet1/2.799
 vlan 799
 nameif dmz799
 security-level 50
 ip address 172.29.12.1 255.255.255.248 

vlan 799
   name "DMZ799"
   tagged B19,B23-B24,C13-C14
   no ip address
   exit

If I assign an IP address on VLAN 799, both interfaces will ping.

The limit on the number of VLAN is not exceeded.

What did I do wrong? Thank you in advance.

Improve this question

1 Answer 1

Reset to default
4

Solved. I registered VLAN 810 on two interfaces on switch to ASA (we have two devices ASA in stack failover). Don't trust GVRP. :-)

Improve this answer
2
  • 3
    The fact is on a Cisco device, the VLAN doesn't come UP if there's no interface on which it is explicitly configured, or a non filtered trunk port. So my guess is, the VLAN was created but was down.
    – JFL
    Commented Feb 21, 2019 at 8:26
  • 1
    @Ruslan Please mark your answer so this post doesn't keep coming up until the end of time as unsolved.
    – Jesse P.
    Commented Feb 21, 2019 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.