Vlan – Subinterfaces on ASA5506-X doesn’t communicate with the switch or computer

cisco-asafirewallNetworkvlan

We are upgrading from ASA5505 to ASA5506-X, but unlike the ASA5505, the new firewall ASA5506-X doesn't have switch ports and does not support vlans on physical interfaces. So, I'm creating vlans on its subinterfaces, assigning an IP address to it, but it doesn't communicate with end devices nor using the layer 3 switch to end devices.

Basically, I'm setting the dhcp server directly on the subinterface of asa5506-x, but it doesn't assign an IP address to the computer (when I connect the computer directly to the interface of asa506-x), the same happens using a switch SG500P.

I can work with the routed interface of the asa5506-x (not sub interface), setup the dhcp server, but then I can't create the vlans on it as it's limited and vlan are only supported on the sub-interfaces of this asa5506-x firewall.

Even if we don't care about the dhcp server for a moment, I simply can't login to the ADSM using the IP address of the sub interface, but if an IP address is given to the physical interface, I can login via the ADSM, I can set up the dhcp server but again no vlans on physical interfaces.

Running config of ASA 5506-X (Note: I'm beginner, and there are some commands I know may be wrong as I was testing)

    ASA Version 9.8(1)
!
hostname ASA5506-X-1038
enable password $sha512$5000$d7ukqoZ+VKJqA80su8CGvg==$vvuGumvyoey96hWjvIBCtg== pbkdf2
names

!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 192.168.1.2 255.255.255.0
!
interface GigabitEthernet1/3
 nameif protrans-int
 security-level 100
 ip address 192.168.3.3 255.255.255.0
!
interface GigabitEthernet1/3.3
 vlan 2
 nameif protrans
 security-level 100
 ip address 192.168.2.3 255.255.255.0
!
interface GigabitEthernet1/4
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 no nameif
 no security-level
 no ip address
!
interface Management1/1
 management-only
 no nameif
 no security-level
 ip address 172.30.30.22 255.255.255.0
!
boot system disk0:/asa981-lfbff-k8.SPA
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network obj-protrans
 subnet 192.168.2.0 255.255.255.0
object network 2
object network real-inside
 subnet 192.168.2.0 255.255.255.0
object network mapped-inside
 range 192.168.3.0 192.168.3.254
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu protrans 1500
mtu protrans-int 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-781-150.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
 nat (any,outside) dynamic interface
object network obj-protrans
 nat (protrans,protrans-int) dynamic interface
object network real-inside
 nat (protrans,protrans-int) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.3.0 255.255.255.0 protrans-int
http 192.168.2.0 255.255.255.0 protrans
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config protrans-int
!
dhcpd address 192.168.1.5-192.168.1.254 inside
dhcpd enable inside
!
dhcpd address 192.168.2.5-192.168.2.254 protrans
dhcpd enable protrans
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:d4d1a0e542439235aa114c86f69c683d

Kindly help. Thanks!

Best Answer

interface GigabitEthernet1/3 nameif protrans-int security-level 100 ip address 192.168.3.3 255.255.255.0

interface GigabitEthernet1/3.3 vlan 2 nameif protrans security-level 100 ip address 192.168.2.3 255.255.255.0

As per your configuration . Interface ethernet 1/3

Cannot be assigned with ip address . It should be no ip address

Example below

Asa(config)# interfàce ethernet 1/3 ASA(config)#no ip address ASA(config)# security level 100 ASA(config)# no shutdown `

ASA(config)#interface ethernet 1/3.3 Asa(config)#ip address 192 .168.2.3 255.255.255.0 ASA(config)# security level 100 ASA(config) no shutdown

Modify configuration as above and try

Configure trunk port in switch allowing all Vlans connecting ASA firewall.

Related Topic