dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
2185
bvn63
join:2013-11-11
viet nam

bvn63

Member

[HELP] VLAN on Router 2811 -> ASA 5505 -> Switch 2950

Good day

I configure VLANs on Internet --> Router 2811 ---> Switch 2950, hosts in VLANs can ping each other and internet access

I had just bought an new ASA 5505 and topology diagram as follows :

Internet --> Router 2811 --> ASA 5505 --> Switch 2950

How to allow VLANs on Router 2811 can go to Switch 2950 via ASA 5505 ?

Anybody can help me ?

Thank you very much.

tubbynet
reminds me of the danse russe
MVM
join:2008-01-16
Gilbert, AZ

tubbynet

MVM

you either need to (a) set the asa up in transparent mode. in this case -- the vlan won't be the same outside --> inside, but it will be mapped to a unique vlan (i.e. outside == 10, inside == 1010).
the other option is to place the asa in routed mode, and use tagged subifs. these won't have direct connections from the router to the switch -- but each vlan on the switch can terminate on the inside of the asa, and you can use multiple vlans on the outside of the asa to route to the router (or a single one).

q,

Nubiatech
soy capitan
join:2007-09-02
Chicago, IL

Nubiatech to bvn63

Member

to bvn63
I don't think this is supported on ASA5505 because it is limited to only 2 vlans in transparent mode. This would work on a 5510 using sub-interfaces and bridge groups.

You can use identity NAT in routed mode, but obviously this will be layer 3, and will break the broadcast domains for each vlan.
HELLFIRE
MVM
join:2009-11-25

HELLFIRE to bvn63

MVM

to bvn63
BASE or sECPLUS licence? If BASE, keep in mind that it does 3 VLANs but NO trunking.
SECPLUS does 20 VLANs and trunking.

Regards

Nubiatech
soy capitan
join:2007-09-02
Chicago, IL

Nubiatech

Member

SecPlus is restricted to 2 active vlans in transparent mode.
20 vlans are supported in routed mode, which doesn't seem to fit this scenario.

Da Geek Kid
join:2003-10-11
::1

Da Geek Kid to bvn63

Member

to bvn63
set your asa to be Default Gateway, configure the ASA to push all the traffic to 2811 using default route to the 2811 and static route for the LAN.
bvn63
join:2013-11-11
viet nam

bvn63

Member

Good day,

Thanks for all your assistance to help me understand this problem.

My ASA appliance : ASA5505-SEC-BUN-K9

I will check again, if cannot routing between VLANS via ASA, after I will temporarily configure my topology diagram as follow :

Internet --> Linksys WRT54GL --> ASA 5505 --> Router 2811 --> Switch 2950

Thank you.
HELLFIRE
MVM
join:2009-11-25

1 edit

HELLFIRE to bvn63

MVM

to bvn63
To check the licence level of your ASA, use this command

show licence
 

and post up the results. I'm almost willing to bet you only have BASE. In which case, two immediate questions
come to mind :

a) how many VLANs did you need for your existing setup, and do you see that growing in the near future?

b) is there a particular reason you need to make it so complex... I can understand about having the 2811 route
(and possibly NAT), and have the ASA for security, but at this point you're overcomplicating things, especially
with this setup you're now proposing
said by bvn63:

Internet --> Linksys WRT54GL --> ASA 5505 --> Router 2811 --> Switch 2950

My 00000010bits -- stick to the KISS principle with your setup. If you REALLY need BOTH the ASA and the 2811, a possible
better design to maximize each device's strengths would be to have the ASA do the NAT and security, but
set up a /30 connection to one of the routed interfaces on the 2811. You then use the 2nd routed interfaces
to do the subints and trunking to the 2950 BUT NO NAT on the 2811, ie. something like this :

ASA NAT OUTSIDE / DHCP address assigned by ISP
|
ASA NAT INSIDE / 192.168.1.1/30
|
2811 / FE0 / 192.168.1.2/30
|
2811 / FE1.2 / 192.168.2.0/24
2811 / FE1.3 / 192.168.3.0/24
2811 / FE1.4 / 192.168.4.0/24
2811 / FE1.5 / 192.168.5.0/24
...
|
|
trunk int to 2950
|
|
V
 

Regards
bvn63
join:2013-11-11
viet nam

bvn63

Member

Good day,

Show licence - It says error, maybe my version is old
ciscoasa# show licence
^
ERROR: % Invalid input detected at '^' marker.

Show version

Cisco Adaptive Security Appliance Software Version 8.2(5)
Device Manager Version 6.4(5)

Compiled on Fri 20-May-11 16:00 by builders
System image file is "disk0:/asa825-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 4 days 19 hours

Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05

0: Int: Internal-Data0/0 : address is 2894.0f0f.34de, irq 11
1: Ext: Ethernet0/0 : address is 2894.0f0f.34d6, irq 255
2: Ext: Ethernet0/1 : address is 2894.0f0f.34d7, irq 255
3: Ext: Ethernet0/2 : address is 2894.0f0f.34d8, irq 255
4: Ext: Ethernet0/3 : address is 2894.0f0f.34d9, irq 255
5: Ext: Ethernet0/4 : address is 2894.0f0f.34da, irq 255
6: Ext: Ethernet0/5 : address is 2894.0f0f.34db, irq 255
7: Ext: Ethernet0/6 : address is 2894.0f0f.34dc, irq 255
8: Ext: Ethernet0/7 : address is 2894.0f0f.34dd, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255

Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 20, DMZ Unrestricted
Inside Hosts : Unlimited
Failover : Active/Standby
VPN-DES : Enabled
VPN-3DES-AES : Enabled
SSL VPN Peers : 2
Total VPN Peers : 25
Dual ISPs : Enabled
VLAN Trunk Ports : 8
Shared License : Disabled
AnyConnect for Mobile : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials : Disabled
Advanced Endpoint Assessment : Disabled
UC Phone Proxy Sessions : 2
Total UC Proxy Sessions : 2
Botnet Traffic Filter : Disabled

This platform has an ASA 5505 Security Plus license.

- I must only 3 VLANs, I think it is enough for my company.
- I want to learn how to use routing between VLANs via ASA, but it is complicate and can't do it on ASA 5505 as you said. I am beginer in ASA, so I dont know much about ASA. I will configure topology diagram as you suggest

Thank you for helping me.

Best Regard
aryoba
MVM
join:2002-08-22

aryoba

MVM

Unless there is a specific (significant) reason to do VLAN trunking between the router and the switch to pass through the ASA firewall, I would go with what HELLFIRE See Profile suggested in regards of network design.

Fortunately, the ASA firewall show version output suggested that it had Security Plus license which allow you to implement more features beyond the basic license.
bvn63
join:2013-11-11
viet nam

bvn63

Member

Thanks aryoba and HELLFIRE.