2

I created subinterface on Cisco ASA 5550 (ver. 9.7.1):

interface GigabitEthernet1/2.810
 vlan 810
 nameif dmz810
 security-level 50
 ip address 172.29.12.33 255.255.255.248

And VLAN 810 on HP ProCurve E5406zl (J8697A):

vlan 810
   name "DMZ810"
   tagged B2,B23-B24
   no ip address
   exit

VLANs are transmitted by GVRP, so we do not need to register them manually on each interface. I don't rigistered VLAN 810 (and many another DMZ) on ASA-HP links. Other networks work, but not VLAN 810. Tagged interfaces on switch - links to another switches.

For verification I assigned on VLAN 810 IP-address:

vlan 810
       name "DMZ810"
       tagged B2,B23-B24
       ip address 172.29.12.37 255.255.255.248
       exit

Bun they don't ping in both directions.

For example, this is a working subinterface and VLAN:

interface GigabitEthernet1/2.799
 vlan 799
 nameif dmz799
 security-level 50
 ip address 172.29.12.1 255.255.255.248 

vlan 799
   name "DMZ799"
   tagged B19,B23-B24,C13-C14
   no ip address
   exit

If I assign an IP address on VLAN 799, both interfaces will ping.

The limit on the number of VLAN is not exceeded.

What did I do wrong? Thank you in advance.

4

Solved. I registered VLAN 810 on two interfaces on switch to ASA (we have two devices ASA in stack failover). Don't trust GVRP. :-)

  • 3
    The fact is on a Cisco device, the VLAN doesn't come UP if there's no interface on which it is explicitly configured, or a non filtered trunk port. So my guess is, the VLAN was created but was down. – JFL Feb 21 at 8:26
  • 1
    @Ruslan Please mark your answer so this post doesn't keep coming up until the end of time as unsolved. – Jesse P. Feb 21 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.