1

I'm havin a problem with my ASA when trying to pass vlans through port channel to a switch. The goal being here that all vlans that we have would go through a single port channel (4 1Gb links for load balancing) to the ASA and routed/firewalled there. I'm quite sure I'm making some beginner mistake here with the ASA.

I have the below configuration but the subinterface Port-channel10.100 on ASA that tries to acquire DHCP lease through the port channel does not get an ip and all other traffic does not work either between the ASA ant the switch on any of the configured vlans.

interface GigabitEthernet0/4
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/6
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/7
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface Port-channel10
 duplex full
 lacp max-bundle 4
 no nameif
 no security-level
 no ip address
!

interface Port-channel10.1
 vlan 1
 nameif lan
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
!This asa DHCP server does not pass leases to the vlan 1 from the switch
dhcpd dns 8.8.8.8 1.1.1.1
dhcpd lease 3000
dhcpd domain somedomain.com
dhcpd option 3 ip 192.168.1.1
!
dhcpd address 192.168.1.100-192.168.1.200 lan
dhcpd enable lan
!
interface Port-channel10.2
 vlan 2
 nameif management
 security-level 100
 ip address 10.10.1.1 255.255.255.0
!
interface Port-channel10.10
 vlan 10
 nameif storage
 security-level 0
 ip address 10.10.10.1 255.255.255.0
!
!This does not get an ip from the isp dhcp server
interface Port-channel10.100
 vlan 100
 nameif wan
 security-level 0
 ip address dhcp
!

Is there something that I need to add to the subinterface configs in order to tell ASA to tag the traffic on vlans 2, 10 and 100 and leave the vlan 1 untagged?

The LAG status itself looks good when I plug one of those ports to my switch, here are the port channel status outputs from my brocade switch and the ASA:

(asa)#sh port-channel 10 summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        U - in use      N - not in use, no aggregation/nameif
        M - not in use, no aggregation due to minimum links not met
        w - waiting to be aggregated
Number of channel-groups in use: 1
Group  Port-channel  Protocol  Span-cluster  Ports
------+-------------+---------+------------+------------------------------------
10     Po10(U)           LACP          No     Gi0/4(I)   Gi0/5(I)   Gi0/6(P)   Gi0/7(I)

Brocade:

ICX6610#sh lag asa
=== LAG "asa" ID 1 (dynamic Deployed) ===
LAG Configuration:
   Ports:         e 1/1/1 to 1/1/4
   Port Count:    4
   Primary Port:  1/1/1
   Trunk Type:    hash-based
   LACP Key:      20001
Deployment: HW Trunk ID 1
Port       Link    State   Dupl Speed Trunk Tag Pvid Pri MAC             Name
1/1/1      Up      Forward Full 1G    1     Yes N/A  0   609c.9f48.2008
1/1/2      Down    None    None None  1     Yes N/A  0   609c.9f48.2008
1/1/3      Down    None    None None  1     Yes N/A  0   609c.9f48.2008
1/1/4      Down    None    None None  1     Yes N/A  0   609c.9f48.2008

Port       [Sys P] [Port P] [ Key ] [Act][Tio][Agg][Syn][Col][Dis][Def][Exp][Ope]
1/1/1           1        1   20001   Yes   L   Agg  Syn  Col  Dis  No   No   Ope
1/1/2           1        1   20001   Yes   L   Agg  Syn  No   No   Def  No   Dwn
1/1/3           1        1   20001   Yes   L   Agg  Syn  No   No   Def  No   Dwn
1/1/4           1        1   20001   Yes   L   Agg  Syn  No   No   Def  No   Dwn


 Partner Info and PDU Statistics
Port          Partner         Partner     LACP      LACP
             System ID         Key     Rx Count  Tx Count
1/1/1    32768-00a3.8e58.f5c1       10      149       135
1/1/2    1-0000.0000.0000        1        0         0
1/1/3    1-0000.0000.0000        2        0         0
1/1/4    1-0000.0000.0000        3        0         0

It looks to me that the port channel configuration itself is correct but the problem is with the vlan configuration somehow. All the traffic through the port channel should be tagged.

Below is the vlan configuration of the switch wan cable connected to port 24:

ICX6610-24 Router#sh vlan
Total PORT-VLAN entries: 4
Maximum PORT-VLAN entries: 64

Legend: [Stk=Stack-Id, S=Slot]

PORT-VLAN 1, Name DEFAULT-VLAN, Priority level0, Spanning tree On
 Untagged Ports: (U1/M1)   5   6   7   8   9  10  11  12  13  14  15  16
 Untagged Ports: (U1/M1)  17  18  19  20  21  22  23
 Untagged Ports: (U1/M2)   2   3   4   5   6   7   8   9  10
 Untagged Ports: (U1/M3)   1   2   3   4   5   6   7
   Tagged Ports: None
   Uplink Ports: None
 DualMode Ports: (U1/M1)   1   2   3   4
 DualMode Ports: (U1/M2)   1
 Mac-Vlan Ports: None
     Monitoring: Disabled

PORT-VLAN 2, Name Management, Priority level0, Spanning tree On
 Untagged Ports: None
   Tagged Ports: (U1/M1)   1   2   3   4
   Tagged Ports: (U1/M2)   1
   Uplink Ports: None
 DualMode Ports: None
 Mac-Vlan Ports: None
     Monitoring: Disabled

PORT-VLAN 10, Name Storage, Priority level0, Spanning tree On
 Untagged Ports: (U1/M3)   8
   Tagged Ports: (U1/M1)   1   2   3   4
   Tagged Ports: (U1/M2)   1
   Uplink Ports: None
 DualMode Ports: None
 Mac-Vlan Ports: None
     Monitoring: Disabled

PORT-VLAN 100, Name WAN, Priority level0, Spanning tree On
 Untagged Ports: (U1/M1)  24
   Tagged Ports: (U1/M1)   1   2   3   4
   Tagged Ports: (U1/M2)   1
   Uplink Ports: None
 DualMode Ports: None
 Mac-Vlan Ports: None
     Monitoring: Disabled

None of the other vlans don't work through the port channel. The wanted configuration for the port channel would be the same as I have for the (U1/M2) 1 interface which goes to my hypervisor and correctly passes all vlans there. Port channel is configured on the switch as follows:

!
lag asa dynamic id 1
 ports ethernet 1/1/1 to 1/1/4
 primary-port 1/1/1
 deploy
!
!
vlan 1 name DEFAULT-VLAN by port
 spanning-tree
!
vlan 2 name Management by port
 tagged ethe 1/1/1 to 1/1/4 ethe 1/2/1
 router-interface ve 2
 spanning-tree
!
vlan 10 name Storage by port
 tagged ethe 1/1/1 to 1/1/4 ethe 1/2/1
 untagged ethe 1/3/8
 spanning-tree
!
vlan 100 name WAN by port
 tagged ethe 1/1/1 to 1/1/4 ethe 1/2/1
 untagged ethe 1/1/24
 spanning-tree
!
11
  • 1
    How are the vlans configured on the switch?
    – Ricky
    Nov 4, 2023 at 10:44
  • 1
    You should not depend on DHCP for addressing your network infrastructure devices. You should use static addressing so that you may still connect to them in case of DHCP unreachability.
    – Ron Maupin
    Nov 4, 2023 at 12:59
  • @RonMaupin that vlan 100 is for wan, updated the question to clarify that, we have no possibility to use static addressing for that for the time being. Wan cable attached to brocade port 24 from where the vlan should be distributed to the ASA through the port channel and other parts of the network if required. Nov 5, 2023 at 6:30
  • @Ricky Updated the question to show relevant config on the switch Nov 5, 2023 at 6:31
  • 1
    Your configuration on the ICX switch seems to have no mention of VLAN tagging configuration or dual mode configuration for either the LAG 'asa' or the individual LAG ports 1/1/1, 1/1/2, etc. Don't you need to configure them for the appropriate VLAN tagging? Otherwise they will only accept untagged frames or will discard frames with tags or change the tags to the default VLAN (not sure how Brocade acts in that situation). Nov 5, 2023 at 7:33

1 Answer 1

2

I got this to work. All I had to do was restart the ASA after which it got the ip from isp dhcp... Then I had to fix the port channel config on the untagged lan part after figuring out that I need to add the lan network directly to the port channel itself instead of subinterface to make it untagged as required by switch and finally add the setroute part to the wan vlan. Below is the final working config:

!
interface GigabitEthernet0/4
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/6
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/7
 duplex full
 channel-group 10 mode active
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 shutdown
 no nameif
 no security-level
 no ip address
!
!Packets are sent and received untagged by the base port channel interface
!Subinterfaces handle tagged traffic only
interface Port-channel10
 !Our default vlan 1 (lan) is untagged all over the infra
 duplex full
 lacp max-bundle 4
 nameif lan
 security-level 90
 ip address 192.168.1.1 255.255.255.0
!
interface Port-channel10.2
 vlan 2
 nameif management
 security-level 100
 ip address 10.10.1.1 255.255.255.0
!
interface Port-channel10.10
 vlan 10
 nameif storage
 security-level 95
 ip address 10.10.10.1 255.255.255.0
!
interface Port-channel10.100
 vlan 100
 nameif wan
 security-level 0
 ip address dhcp setroute
!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.