Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6

Step 1

interface vlan number

hostname(config)# interface vlan 100

Adds a VLAN interface, where the number is between 1 and 4090.

To remove this VLAN interface and all associated configuration, enter the no interface vlan command. Because this interface also includes the interface name configuration, and the name is used in other commands, those commands are also removed.

Step 2

(Optional for the Base license)

no forward interface vlan number

hostname(config-if)# no forward interface vlan 101

Allows this interface to be the third VLAN by limiting it from initiating contact to one other VLAN.

The number specifies the VLAN ID to which this VLAN interface cannot initiate traffic.

With the Base license, you can only configure a third VLAN if you use this command to limit it.

For example, you have one VLAN assigned to the outside for Internet access, one VLAN assigned to an inside business network, and a third VLAN assigned to your home network. The home network does not need to access the business network, so you can use the no forward interface command on the home VLAN; the business network can access the home network, but the home network cannot access the business network.

If you already have two VLAN interfaces configured with a nameif command, be sure to enter the no forward interface command before the nameif command on the third interface; the ASA does not allow three fully functioning VLAN interfaces with the Base license on the ASA 5505.

Note If you upgrade to the Security Plus license, you can remove this command and achieve full functionality for this interface. If you leave this command in place, this interface continues to be limited even after upgrading.

Step 1

interface ethernet0/ port

hostname(config)# interface ethernet0/1

Specifies the switch port you want to configure, where port is 0 through 7.

Step 2

switchport access vlan number

hostname(config-if)# switchport access vlan 100

Assigns this switch port to a VLAN, where number is the VLAN ID, between 1 and 4090. See the “Configuring VLAN Interfaces” section to configure the VLAN interface that you want to assign to this switch port. To view configured VLANs, enter the show interface command.

Note You might assign multiple switch ports to the primary or backup VLANs if the Internet access device includes Layer 2 redundancy.

Step 3

(Optional)

switchport protected

hostname(config-if)# switchport protected

Prevents the switch port from communicating with other protected switch ports on the same VLAN.

You might want to prevent switch ports from communicating with each other if the devices on those switch ports are primarily accessed from other VLANs, you do not need to allow intra-VLAN access, and you want to isolate the devices from each other in case of infection or other security breach. For example, if you have a DMZ that hosts three web servers, you can isolate the web servers from each other if you apply the switchport protected command to each switch port. The inside and outside networks can both communicate with all three web servers, and vice versa, but the web servers cannot communicate with each other.

Step 4

(Optional)

speed { auto | 10 | 100 }

hostname(config-if)# speed 100

Sets the speed. The auto setting is the default. If you set the speed to anything other than auto on PoE ports Ethernet 0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will not be detected and supplied with power.

Step 5

(Optional)

duplex { auto | full | half }

hostname(config-if)# duplex full

Sets the duplex. The auto setting is the default. If you set the duplex to anything other than auto on PoE ports Ethernet 0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will not be detected and supplied with power.

Step 6

no shutdown

hostname(config-if)# no shutdown

Enables the switch port. To disable the switch port, enter the shutdown command.

Step 1

interface ethernet0/ port

hostname(config)# interface ethernet0/1

Specifies the switch port you want to configure, where port is 0 through 7.

Step 2

To assign VLANs to this trunk, do one or more of the following:

switchport trunk allowed vlan vlan_range

hostname(config)# switchport trunk allowed vlan 100-200

Identifies one or more VLANs that you can assign to the trunk port, where the vlan_range (with VLANs between 1 and 4090) can be identified in one of the following ways:

• A single number (n)
• A range (n-x)
• Separate numbers and ranges by commas, for example:

5,7-10,13,45-100

You can enter spaces instead of commas, but the command is saved to the configuration with commas.

You can include the native VLAN in this command, but it is not required; the native VLAN is passed whether it is included in this command or not.

switchport trunk native vlan vlan_id

hostname(config-if)# switchport trunk native vlan 100

Assigns a native VLAN to the trunk, where the vlan_id is a single VLAN ID between 1 and 4090.

Packets on the native VLAN are not modified when sent over the trunk. For example, if a port has VLANs 2, 3 and 4 assigned to it, and VLAN 2 is the native VLAN, then packets on VLAN 2 that egress the port are not modified with an 802.1Q header. Frames which ingress (enter) this port and have no 802.1Q header are put into VLAN 2.

Each port can only have one native VLAN, but every port can have either the same or a different native VLAN.

Step 3

switchport mode trunk

hostname(config-if)# switchport mode trunk

Makes this switch port a trunk port. To restore this port to access mode, enter the switchport mode access command.

Step 4

(Optional)

switchport protected

hostname(config-if)# switchport protected

Prevents the switch port from communicating with other protected switch ports on the same VLAN.

You might want to prevent switch ports from communicating with each other if the devices on those switch ports are primarily accessed from other VLANs, you do not need to allow intra-VLAN access, and you want to isolate the devices from each other in case of infection or other security breach. For example, if you have a DMZ that hosts three web servers, you can isolate the web servers from each other if you apply the switchport protected command to each switch port. The inside and outside networks can both communicate with all three web servers, and vice versa, but the web servers cannot communicate with each other.

Step 5

(Optional)

speed { auto | 10 | 100 }

hostname(config-if)# speed 100

Sets the speed. The auto setting is the default. If you set the speed to anything other than auto on PoE ports Ethernet 0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will not be detected and supplied with power.

Step 6

(Optional)

duplex { auto | full | half }

hostname(config-if)# duplex full

Sets the duplex. The auto setting is the default. If you set the duplex to anything other than auto on PoE ports Ethernet 0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will not be detected and supplied with power.

Step 7

no shutdown

hostname(config-if)# no shutdown

Enables the switch port. To disable the switch port, enter the shutdown command.