Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6

Auto-MDI/MDIX Feature

For RJ-45 interfaces on the ASA 5500 series, the default auto-negotiation setting also includes the Auto-MDI/MDIX feature. Auto-MDI/MDIX eliminates the need for crossover cabling by performing an internal crossover when a straight cable is detected during the auto-negotiation phase. Either the speed or duplex must be set to auto-negotiate to enable Auto-MDI/MDIX for the interface. If you explicitly set both the speed and duplex to a fixed value, thus disabling auto-negotiation for both settings, then Auto-MDI/MDIX is also disabled. For Gigabit Ethernet, when the speed and duplex are set to 1000 and full, then the interface always auto-negotiates; therefore Auto-MDI/MDIX is always enabled and you cannot disable it.

Interfaces in Transparent Mode

Interfaces in transparent mode belong to a “bridge group,” one bridge group for each network. You can have up to eight bridge groups of four interfaces each per context or in single mode. For more information about bridge groups, see the “Bridge Groups in Transparent Mode” section.

Management Interface

• Management Interface Overview
• Management Slot/Port Interface
• Using Any Interface for Management-Only Traffic
• Management Interface for Transparent Mode
• No Support for Redundant Management Interfaces
• Management 0/0 Interface on the ASA 5512-X through ASA 5555-X

Management Interface Overview

You can manage the ASA by connecting to:

• Any through-traffic interface
• A dedicated Management Slot / Port interface (if available for your model)

You may need to configure management access to the interface according to Chapter37, “Configuring Management Access”

Management Slot/Port Interface

Table 12-1 shows the Management interfaces per model.-

Note If you installed an IPS module, then the IPS module management interface(s) provides management access for the IPS module only. For the ASA 5512-X through ASA 5555-X, the IPS SSP software module uses the same physical Management 0/0 interface as the ASA.

Using Any Interface for Management-Only Traffic

You can use any interface as a dedicated management-only interface by configuring it for management traffic, including an EtherChannel interface (see the management-only command).

Management Interface for Transparent Mode

In transparent firewall mode, in addition to the maximum allowed through-traffic interfaces, you can also use the Management interface (either the physical interface, a subinterface (if supported for your model), or an EtherChannel interface comprised of Management interfaces (if you have multiple Management interfaces)) as a separate management interface. You cannot use any other interface types as management interfaces.

If your model does not include a Management interface, you must manage the transparent firewall from a data interface.

In multiple context mode, you cannot share any interfaces, including the Management interface, across contexts. To provide management per context, you can create subinterfaces of the Management interface and allocate a Management subinterface to each context. Note that the ASA 5512-X through ASA 5555-X do not allow subinterfaces on the Management interface, so for per-context management, you must connect to a data interface.

For 8.4(1) and later, the management interface is not part of a normal bridge group. Note that for operational purposes, it is part of a non-configurable bridge group.

Note In transparent firewall mode, the management interface updates the MAC address table in the same manner as a data interface; therefore you should not connect both a management and a data interface to the same switch unless you configure one of the switch ports as a routed port (by default Cisco Catalyst switches share a MAC address for all VLAN switch ports). Otherwise, if traffic arrives on the management interface from the physically-connected switch, then the ASA updates the MAC address table to use the management interface to access the switch, instead of the data interface. This action causes a temporary traffic interruption; the ASA will not re-update the MAC address table for packets from the switch to the data interface for at least 30 seconds for security reasons.

No Support for Redundant Management Interfaces

Redundant interfaces do not support Management slot / port interfaces as members. You also cannot set a redundant interface comprised of non-Management interfaces as management-only.

Management 0/0 Interface on the ASA 5512-X through ASA 5555-X

The Management 0/0 interface on the ASA 5512-X through ASA 5555-X has the following characteristics:

• No through traffic support
• No subinterface support
• No priority queue support
• No multicast MAC support
• The IPS SSP software module shares the Management 0/0 interface. Separate MAC addresses and IP addresses are supported for the ASA and IPS module. You must perform configuration of the IPS IP address within the IPS operating system. However, physical characteristics (such as enabling the interface) are configured on the ASA.

Redundant Interfaces

A logical redundant interface consists of a pair of physical interfaces: an active and a standby interface. When the active interface fails, the standby interface becomes active and starts passing traffic. You can configure a redundant interface to increase the ASA reliability. This feature is separate from device-level failover, but you can configure redundant interfaces as well as device-level failover if desired.

Redundant Interface MAC Address

The redundant interface uses the MAC address of the first physical interface that you add. If you change the order of the member interfaces in the configuration, then the MAC address changes to match the MAC address of the interface that is now listed first. Alternatively, you can assign a MAC address to the redundant interface, which is used regardless of the member interface MAC addresses (see the “Configuring the MAC Address and MTU” section or the “Configuring Multiple Contexts” section). When the active interface fails over to the standby, the same MAC address is maintained so that traffic is not disrupted.

EtherChannels

An 802.3ad EtherChannel is a logical interface (called a port-channel interface) consisting of a bundle of individual Ethernet links (a channel group) so that you increase the bandwidth for a single network. A port channel interface is used in the same way as a physical interface when you configure interface-related features.

You can configure up to 48 EtherChannels.

This section includes the following topics:

• Channel Group Interfaces
• Connecting to an EtherChannel on Another Device
• Link Aggregation Control Protocol
• Load Balancing
• EtherChannel MAC Address

Channel Group Interfaces

Each channel group can have eight active interfaces. Note that you can assign up to 16 interfaces to a channel group. While only eight interfaces can be active, the remaining interfaces can act as standby links in case of interface failure.

All interfaces in the channel group must be the same type and speed. The first interface added to the channel group determines the correct type and speed.

The EtherChannel aggregates the traffic across all the available active interfaces in the channel. The port is selected using a proprietary hash algorithm, based on source or destination MAC addresses, IP addresses, TCP and UDP port numbers and vlan numbers.

Connecting to an EtherChannel on Another Device

The device to which you connect the ASA EtherChannel must also support 802.3ad EtherChannels; for example, you can connect to the Catalyst 6500 switch.

When the switch is part of a Virtual Switching System (VSS), then you can connect ASA interfaces within the same EtherChannel to separate switches in the VSS. The switch interfaces are members of the same EtherChannel port-channel interface, because the separate switches act like a single switch (see Figure 12-1).

Figure 12-1 Connecting to a VSS

If you use the ASA in an Active/Standby failover deployment, then you need to create separate EtherChannels on the switches in the VSS, one for each ASA (see Figure 12-1). On each ASA, a single EtherChannel connects to both switches. Even if you could group all switch interfaces into a single EtherChannel connecting to both ASAs (in this case, the EtherChannel will not be established because of the separate ASA system IDs), a single EtherChannel would not be desirable because you do not want traffic sent to the standby ASA.

Figure 12-2 Active/Standby Failover and VSS

Link Aggregation Control Protocol

The Link Aggregation Control Protocol (LACP) aggregates interfaces by exchanging the Link Aggregation Control Protocol Data Units (LACPDUs) between two network devices.

You can configure each physical interface in an EtherChannel to be:

• Active—Sends and receives LACP updates. An active EtherChannel can establish connectivity with either an active or a passive EtherChannel. You should use the active mode unless you need to minimize the amount of LACP traffic.
• Passive—Receives LACP updates. A passive EtherChannel can only establish connectivity with an active EtherChannel.
• On—The EtherChannel is always on, and LACP is not used. An “on” EtherChannel can only establish a connection with another “on” EtherChannel.

LACP coordinates the automatic addition and deletion of links to the EtherChannel without user intervention. It also handles misconfigurations and checks that both ends of member interfaces are connected to the correct channel group. “On” mode cannot use standby interfaces in the channel group when an interface goes down, and the connectivity and configurations are not checked.

Load Balancing

The ASA distributes packets to the interfaces in the EtherChannel by hashing the source and destination IP address of the packet (this criteria is configurable; see the “Customizing the EtherChannel” section). The hash result is a 3-bit value (0 to 7).

The eight hash result values are distributed in a round robin fashion between the channel group interfaces, starting with the interface with the lowest ID (slot/port). For example, all packets with a hash result of 0 go to GigabitEthernet 0/0, packets with a hash result of 1 go to GigabitEthernet 0/1, packets with a hash result of 2 go to GigabitEthernet 0/2, and so on.

Because there are eight hash result values regardless of how many active interfaces are in the EtherChannel, packets might not be distributed evenly depending on the number of active interfaces.

Table 12-2 shows the load balancing amounts per interface for each number of active interfaces. The active interfaces in bold have even distribution.

If an active interface goes down and is not replaced by a standby interface, then traffic is rebalanced between the remaining links. The failure is masked from both Spanning Tree at Layer 2 and the routing table at Layer 3, so the switchover is transparent to other network devices.

EtherChannel MAC Address

All interfaces that are part of the channel group share the same MAC address. This feature makes the EtherChannel transparent to network applications and users, because they only see the one logical connection; they have no knowledge of the individual links.

The port-channel interface uses the lowest numbered channel group interface MAC address as the port-channel MAC address. Alternatively you can manually configure a MAC address for the port-channel interface. In multiple context mode, you can automatically assign unique MAC addresses to interfaces, including an EtherChannel port interface. We recommend manually, or in multiple context mode, automatically configuring a unique MAC address in case the group channel interface membership changes. If you remove the interface that was providing the port-channel MAC address, then the port-channel MAC address changes to the next lowest numbered interface, thus causing traffic disruption.

Task Flow for Starting Interface Configuration

Note If you have an existing configuration, and want to convert interfaces that are in use to a redundant or EtherChannel interface, perform your configuration offline to minimize disruption. See the “Converting In-Use Interfaces to a Redundant or EtherChannel Interface” section.

To start configuring interfaces, perform the following steps:

Step 1 (Multiple context mode) Complete all tasks in this section in the system execution space. To change from the context to the system execution space, enter the changeto system command.

Step 2 Enable the physical interface, and optionally change Ethernet parameters. See the “Enabling the Physical Interface and Configuring Ethernet Parameters” section.

Physical interfaces are disabled by default.

Step 3 (Optional) Configure redundant interface pairs. See the “Configuring a Redundant Interface” section.

A logical redundant interface pairs an active and a standby physical interface. When the active interface fails, the standby interface becomes active and starts passing traffic.

Step 4 (Optional) Configure an EtherChannel. See the “Configuring an EtherChannel” section.

An EtherChannel groups multiple Ethernet interfaces into a single logical interface.

Note You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA 5550, as part of an EtherChannel.

Step 5 (Optional) Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking” section.

Step 6 (Optional) Enable jumbo frame support on the ASA 5580 and 5585-X according to the “Enabling Jumbo Frame Support (Supported Models)” section.

Step 7 (Multiple context mode only) To complete the configuration of interfaces in the system execution space, perform the following tasks that are documented in Chapter 6, “Configuring Multiple Context Mode”:

• To assign interfaces to contexts, see the “Configuring a Security Context” section.
• (Optional) To automatically assign unique MAC addresses to context interfaces, see the “Automatically Assigning MAC Addresses to Context Interfaces” section.

The MAC address is used to classify packets within a context. If you share an interface, but do not have unique MAC addresses for the interface in each context, then the destination IP address is used to classify packets. Alternatively, you can manually assign MAC addresses within the context according to the “Configuring the MAC Address and MTU” section.

Step 8 Complete the interface configuration according to “Completing Interface Configuration (Routed Mode),” or Chapter9, “Completing Interface Configuration (Transparent Mode)”

Converting In-Use Interfaces to a Redundant or EtherChannel Interface

If you have an existing configuration and want to take advantage of the redundant or EtherChannel interface feature for interfaces that are currently in use, you will have some amount of downtime when you convert to the logical interfaces.

This section provides an overview of how to convert your existing interfaces to a redundant or EtherChannel interface with minimal downtime. See the “Configuring a Redundant Interface” section and the “Configuring an EtherChannel” section fore more information.

• Detailed Steps (Single Mode)
• Detailed Steps (Multiple Mode)

Detailed Steps (Single Mode)

We recommend that you update your configuration offline as a text file, and reimport the whole configuration for the following reasons:

• Because you cannot add a named interface as a member of a redundant or EtherChannel interface, you must remove the name from the interface. When you remove the name from the interface, any command that referred to that name is deleted. Because commands that refer to interface names are widespread throughout the configuration and affect multiple features, removing a name from an in-use interface at the CLI or in ASDM would cause significant damage to your configuration, not to mention significant downtime while you reconfigure all your features around a new interface name.
• Changing your configuration offline lets you use the same interface names for your new logical interfaces, so you do not need to touch the feature configurations that refer to interface names. You only need to change the interface configuration.
• Clearing the running configuration and immediately applying a new configuration will minimize the downtime of your interfaces. You will not be waiting to configure the interfaces in real time.

Step 1 Connect to the ASA; if you are using failover, connect to the active ASA.

Step 2 If you are using failover, disable failover by entering the no failover command.

Step 3 Copy the running configuration by entering the more system:running-config command and copying the display output to a text editor.

Be sure to save an extra copy of the old configuration in case you make an error when you edit it.

Step 4 For each in-use interface that you want to add to a redundant or EtherChannel interface, cut and paste all commands under the interface command to the end of the interface configuration section for use in creating your new logical interfaces. The only exceptions are the following commands, which should stay with the physical interface configuration:

• media-type
• speed
• duplex
• flowcontrol

Note You can only add physical interfaces to an EtherChannel or redundant interface; you cannot have VLANs configured for the physical interfaces.

Be sure to match the above values for all interfaces in a given EtherChannel or redundant interface. Note that the duplex setting for an EtherChannel interface must be Full or Auto.

For example, you have the following interface configuration. The bolded commands are the ones we want to use with three new EtherChannel interfaces, and that you should cut and paste to the end of the interface section.

Step 5 Above each pasted command section, create your new logical interfaces by entering one of the following commands:

• interface redundant number [1-8]
• interface port-channel channel_id [1-48]

For example:

Step 6 Assign the physical interfaces to the new logical interfaces:

• Redundant interface—Enter the following commands under the new interface redundant command:

Where the physical interfaces are any two interfaces of the same type (either formerly in use or unused). You cannot assign a Management interface to a redundant interface.

For example, to take advantage of existing cabling, you would continue to use the formerly in-use interfaces in their old roles as part of the inside and outside redundant interfaces:

• EtherChannel interface—Enter the following command under each interface you want to add to the EtherChannel (either formerly in use or unused). You can assign up to 16 interfaces per EtherChannel, although only eight can be active; the others are in a standby state in case of failure.

For example, to take advantage of existing cabling, you would continue to use the formerly in-use interfaces in their old roles as part of the inside and outside EtherChannel interfaces:

Step 7 Enable each formerly unused interface that is now part of a logical interface by adding no in front of the shutdown command.

For example, your final EtherChannel configuration is:

Note Other optional EtherChannel parameters can be configured after you import the new configuration. See the “Configuring an EtherChannel” section.

Step 8 At the ASA CLI prompt, perform the following steps depending on your connection (console or remote).

• Console connection:

a. Copy the entire new configuration to the clipboard, including the altered interface section.

b. Clear the running configuration by entering:

Traffic through the ASA stops at this point.

c. Paste in the new configuration at the prompt.

Traffic through the ASA resumes.

• Remote connection:

a. Save the new configuration to a TFTP or FTP server, so you can copy it to the startup configuration on the ASA. For example, you can run a TFTP or FTP server on your PC.

b. Clear the startup configuration by entering:

c. Copy the new configuration to the startup configuration by entering:

See the “Downloading a File to a Specific Location” section

d. Reload the ASA using the reload command. Do not save the running configuration.

Step 9 Reenable failover by entering the failover command.

Detailed Steps (Multiple Mode)

We recommend that you update your system and context configurations offline as text files, and reimport them for the following reasons:

• Because you cannot add an allocated interface as a member of a redundant or EtherChannel interface, you must deallocate the interface from any contexts. When you deallocate the interface, any context command that referred to that interface is deleted. Because commands that refer to interfaces are widespread throughout the configuration and affect multiple features, removing an allocation from an in-use interface at the CLI or in ASDM would cause significant damage to your configuration, not to mention significant downtime while you reconfigure all your features around a new interface.
• Changing your configuration offline lets you use the same interface names for your new logical interfaces, so you do not need to touch the feature configurations that refer to interface names. You only need to change the interface configuration.
• Clearing the running system configuration and immediately applying a new configuration will minimize the downtime of your interfaces. You will not be waiting to configure the interfaces in real time.

Step 1 Connect to the ASA, and change to the system; if you are using failover, connect to the active ASA.

Step 2 If you are using failover, disable failover by entering the no failover command.

Step 3 In the system, copy the running configuration by entering the more system:running-config command and copying the display output to a text editor.

Be sure to save an extra copy of the old configuration in case you make an error when you edit it.

For example, you have the following interface configuration and allocation in the system configuration, with shared interfaces between two contexts.

System

Step 4 Get copies of all context configurations that will use the new EtherChannel or redundant interface. See the “Backing Up a Context Configuration or Other File in Flash Memory” section.

For example, you download the following context configurations (interface configuration shown):

CustomerA Context

CustomerB Context

Step 5 In the system configuration, create the new logical interfaces according to the “Configuring a Redundant Interface” section or the “Configuring an EtherChannel” section. Be sure to enter the no shutdown command on any additional physical interfaces you want to use as part of the logical interface.

Note You can only add physical interfaces to an EtherChannel or redundant interface; you cannot have VLANs configured for the physical interfaces.

Be sure to match physical interface parameters such as speed and duplex for all interfaces in a given EtherChannel or redundant interface. Note that the duplex setting for an EtherChannel interface must be Full or Auto.

For example, the new configuration is:

System

Step 6 Change the interface allocation per context to use the new EtherChannel or redundant interfaces. See the “Configuring a Security Context” section.

For example, to take advantage of existing cabling, you would continue to use the formerly in-use interfaces in their old roles as part of the inside and outside redundant interfaces:

Note You might want to take this opportunity to assign mapped names to interfaces if you have not done so already. For example, the configuration for customerA does not need to be altered at all; it just needs to be reapplied on the ASA. The customerB configuration, however, needs to have all of the interface IDs changed; if you assign mapped names for customerB, you still have to change the interface IDs in the context configuration, but mapped names might help future interface changes.

Step 7 For contexts that do not use mapped names, change the context configuration to use the new EtherChannel or redundant interface ID. (Contexts that use mapped interface names do not require any alteration.)

For example:

CustomerB Context

Step 8 Copy the new context configuration files over the old ones. For example, if your contexts are on an FTP server, copy over the existing files (making backups as desired) using FTP. If your contexts are in flash memory, you can use the copy command and run a TFTP or FTP server on your PC, or use secure copy. See the “Downloading a File to a Specific Location” section. This change only affects the startup configuration; the running configuration is still using the old context configuration.

Step 9 At the ASA system CLI prompt, perform the following steps depending on your connection (console or remote).

• Console connection:

a. Copy the entire new system configuration to the clipboard, including the altered interface section.

b. Clear the running configuration (both system and contexts) by entering:

Traffic through the ASA stops at this point.

c. Paste in the new system configuration at the prompt.

All of the new context configurations now reload. When they are finished reloading, traffic through the ASA resumes.

• Remote connection:

a. Save the new system configuration to a TFTP or FTP server, so you can copy it to the startup configuration on the ASA. For example, you can run a TFTP or FTP server on your PC.

b. Clear the startup configuration by entering:

c. Copy the new system configuration to the startup configuration by entering:

See the “Downloading a File to a Specific Location” section

d. Reload the ASA using the reload command. Do not save the running configuration.

Step 10 Reenable failover by entering the failover command.

Enabling the Physical Interface and Configuring Ethernet Parameters

This section describes how to:

• Enable the physical interface
• Set a specific speed and duplex (if available)
• Enable pause frames for flow control

Prerequisites

For multiple context mode, complete this procedure in the system execution space. To change from the context to the system execution space, enter the changeto system command.

Detailed Steps

What to Do Next

Optional Tasks:

• Configure redundant interface pairs. See the “Configuring a Redundant Interface” section.
• Configure an EtherChannel. See the “Configuring an EtherChannel” section.
• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking” section.

Required Tasks:

• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC addresses to context interfaces. See the “Configuring Multiple Contexts” section.
• For single context mode, complete the interface configuration. See “Completing Interface Configuration (Routed Mode),” or Chapter9, “Completing Interface Configuration (Transparent Mode)”

Configuring a Redundant Interface

A logical redundant interface consists of a pair of physical interfaces: an active and a standby interface. When the active interface fails, the standby interface becomes active and starts passing traffic. You can configure a redundant interface to increase the ASA reliability. This feature is separate from device-level failover, but you can configure redundant interfaces as well as failover if desired.

This section describes how to configure redundant interfaces and includes the following topics:

• Configuring a Redundant Interface
• Changing the Active Interface

Configuring a Redundant Interface

This section describes how to create a redundant interface. By default, redundant interfaces are enabled.

Guidelines and Limitations

• You can configure up to 8 redundant interface pairs.
• Redundant interface delay values are configurable, but by default the ASA inherits the default delay values based on the physical type of its member interfaces.
• See also the “Redundant Interface Guidelines” section.

Prerequisites

• Both member interfaces must be of the same physical type. For example, both must be Ethernet.
• You cannot add a physical interface to the redundant interface if you configured a name for it. You must first remove the name using the no nameif command.
• For multiple context mode, complete this procedure in the system execution space. To change from the context to the system execution space, enter the changeto system command.

Caution If you are using a physical interface already in your configuration, removing the name will clear any configuration that refers to the interface.

---

Detailed Steps

Examples

The following example creates two redundant interfaces:

What to Do Next

Optional Task:

• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking” section.

Required Tasks:

• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC addresses to context interfaces. See the “Configuring Multiple Contexts” section.
• For single context mode, complete the interface configuration. See the “Completing Interface Configuration (Routed Mode),” or Chapter9, “Completing Interface Configuration (Transparent Mode)”

Changing the Active Interface

By default, the active interface is the first interface listed in the configuration, if it is available. To view which interface is active, enter the following command:

For example:

To change the active interface, enter the following command:

where the redundant number argument is the redundant interface ID, such as redundant1.

The physical_interface is the member interface ID that you want to be active.

Configuring an EtherChannel

This section describes how to create an EtherChannel port-channel interface, assign interfaces to the EtherChannel, and customize the EtherChannel.

This section includes the following topics:

• Adding Interfaces to the EtherChannel
• Customizing the EtherChannel

Adding Interfaces to the EtherChannel

This section describes how to create an EtherChannel port-channel interface and assign interfaces to the EtherChannel. By default, port-channel interfaces are enabled.

Guidelines and Limitations

• You can configure up to 48 EtherChannels.
• Each channel group can have eight active interfaces. Note that you can assign up to 16 interfaces to a channel group. While only eight interfaces can be active, the remaining interfaces can act as standby links in case of interface failure.
• You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA 5550, as part of an EtherChannel.
• See also the “EtherChannel Guidelines” section.

Prerequisites

• All interfaces in the channel group must be the same type, speed, and duplex. Half duplex is not supported.
• You cannot add a physical interface to the channel group if you configured a name for it. You must first remove the name using the no nameif command.
• For multiple context mode, complete this procedure in the system execution space. To change from the context to the system execution space, enter the changeto system command.

Caution If you are using a physical interface already in your configuration, removing the name will clear any configuration that refers to the interface.

---

Detailed Steps

What to Do Next

Optional Tasks:

• Customize the EtherChannel interface. See the “Customizing the EtherChannel” section.
• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking” section.

Required Tasks:

• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC addresses to context interfaces. See the “Configuring Multiple Contexts” section.
• For single context mode, complete the interface configuration. See the “Completing Interface Configuration (Routed Mode),” or Chapter9, “Completing Interface Configuration (Transparent Mode)”

Customizing the EtherChannel

This section describes how to set the maximum number of interfaces in the EtherChannel, the minimum number of operating interfaces for the EtherChannel to be active, the load balancing algorithm, and other optional parameters.

Detailed Steps

What to Do Next

Optional Task:

• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking” section.

Required Tasks:

• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC addresses to context interfaces. See the “Configuring Multiple Contexts” section.
• For single context mode, complete the interface configuration. See the “Completing Interface Configuration (Routed Mode),” or Chapter9, “Completing Interface Configuration (Transparent Mode)”

Configuring VLAN Subinterfaces and 802.1Q Trunking

Subinterfaces let you divide a physical, redundant, or EtherChannel interface into multiple logical interfaces that are tagged with different VLAN IDs. An interface with one or more VLAN subinterfaces is automatically configured as an 802.1Q trunk. Because VLANs allow you to keep traffic separate on a given physical interface, you can increase the number of interfaces available to your network without adding additional physical interfaces or ASAs. This feature is particularly useful in multiple context mode so that you can assign unique interfaces to each context.

Guidelines and Limitations

• Maximum subinterfaces—To determine how many VLAN subinterfaces are allowed for your platform, see the “Licensing Requirements for ASA 5510 and Higher Interfaces” section.
• Preventing untagged packets on the physical interface—If you use subinterfaces, you typically do not also want the physical interface to pass traffic, because the physical interface passes untagged packets. This property is also true for the active physical interface in a redundant interface pair. Because the physical or redundant interface must be enabled for the subinterface to pass traffic, ensure that the physical or redundant interface does not pass traffic by leaving out the nameif command. If you want to let the physical or redundant interface pass untagged packets, you can configure the nameif command as usual. See “Completing Interface Configuration (Routed Mode),” or “Completing Interface Configuration (Transparent Mode),” for more information about completing the interface configuration.
• (ASA 5512-X through ASA 5555-X) You cannot configure subinterfaces on the Management 0/0 interface.

Prerequisites

For multiple context mode, complete this procedure in the system execution space. To change from the context to the system execution space, enter the changeto system command.

Detailed Steps

What to Do Next

(Optional) For the ASA 5580 and 5585-X, enable jumbo frame support according to the “Enabling Jumbo Frame Support (Supported Models)” section.

Enabling Jumbo Frame Support (Supported Models)

A jumbo frame is an Ethernet packet larger than the standard maximum of 1518 bytes (including Layer 2 header and FCS), up to 9216 bytes. You can enable support for jumbo frames for all interfaces by increasing the amount of memory to process Ethernet frames. Assigning more memory for jumbo frames might limit the maximum use of other features, such as access lists.

Supported models include:

• ASA 5512-X
• ASA 5515-X
• ASA 5525-X
• ASA 5545-X
• ASA 5555-X
• ASA 5580
• ASA 5585-X

Prerequisites

• In multiple context mode, set this option in the system execution space.
• Changes in this setting require you to reload the ASA.
• Be sure to set the MTU for each interface that needs to transmit jumbo frames to a higher value than the default 1500; for example, set the value to 9000 using the mtu command. See the “Configuring the MAC Address and MTU” section. In multiple context mode, set the MTU within each context.

Detailed Steps

Examples

The following example enables jumbo frame reservation, saves the configuration, and reloads the ASA:

Physical Interface Parameters Example

The following example configures parameters for the physical interface in single mode:

Subinterface Parameters Example

The following example configures parameters for a subinterface in single mode:

Multiple Context Mode Example

The following example configures interface parameters in multiple context mode for the system configuration, and allocates the gigabitethernet 0/1.1 subinterface to contextA:

EtherChannel Example

The following example configures three interfaces as part of an EtherChannel. It also sets the system priority to be a higher priority, and GigabitEthernet 0/2 to be a higher priority than the other interfaces in case more than eight interfaces are assigned to the EtherChannel.