# Cisco ASA VLANs and Sub-Interfaces
**URL:** https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824
**Category:** Lessons Discussion
**Created:** [December 19, 2016, 4:38pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824 "2016-12-19T16:38:14Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 19, 2016, 4:38pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/1 "2016-12-19T16:38:14Z")
This topic is to discuss the following lesson:
> **[Cisco ASA VLANs and Sub-Interfaces](https://networklessons.com/cisco/asa-firewall/cisco-asa-vlans-sub-interfaces)**
>
> This lesson explains how to configure Trunking, VLANs and sub-interfaces on your Cisco ASA Firewall.
---
### Author:  [@Openlearner](https://forum.networklessons.com/u/Openlearner)
#### Post date: [January 27, 2015, 1:55am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/2 "2015-01-27T01:55:50Z")
Question:
Why I can not create sub-interfaces if I have the security plus license?
Maximum Physical Interfaces : 8 perpetual
VLANs : 20 DMZ Unrestricted
Dual ISPs : Enabled perpetual
VLAN Trunk Ports : 8 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Standby perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 25 perpetual
Total VPN Peers : 25 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
This platform has an ASA 5505 Security Plus license.
Please advise
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [January 27, 2015, 8:11am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/3 "2015-01-27T08:11:35Z")
Hi Alfredo,
The ASA 5505 only has switchports and it doesn’t support sub-interfaces. To make it work, you should make one of the interfaces a trunk that connects to the switch and then use SVI interfaces. For example:
interface Ethernet 0/0
switchport mode trunk
interface vlan 10
nameif INSIDE
security-level 100
ip address 192.168.10.254 255.255.255.0
Did this from memory but that should do the job.
Rene
---
### Author:  [@bill.macmillan](https://forum.networklessons.com/u/bill.macmillan)
#### Post date: [March 5, 2015, 4:33pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/4 "2015-03-05T16:33:26Z")
If I have an existing interface on an ASA5580 redundant pair and want to create subinterfaces on that interface are there any production challenges I will face? Let say I have Gi8/2 with an existing ip 172.21.16.254, now I want to create two subinterface on Gi8/2 one for 172.21.16.x and one for 10.248.80.x. I know how to create sub-interfaces however not sure of the impact, I know when I move 172.21.16 to a subinterface I will lose connectivity while I reconfig the interface but I am wondering if I need to reload the ASA once the config is done or will it update as I config without a reload requirement. Any other thoughts you might have. I also realize that I need to change the access switchport connection to a trunk port.
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [March 10, 2015, 12:42pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/5 "2015-03-10T12:42:07Z")
Hi Bill,
It shouldn’t be a problem and downtime should be minimum. Once you move the configuration from the physical interface to the sub-interface and set the switchport to trunk, it will work immediately. No need to reboot the ASA or anything.
Rene
---
### Author:  [@chris.m.chavez](https://forum.networklessons.com/u/chris.m.chavez)
#### Post date: [July 10, 2015, 11:00am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/6 "2015-07-10T11:00:02Z")
Hello Rene,
This seems to work on the 5506 so far, Is there a way to specify a native VLAN on the ASA port?
Thanks,
Chris
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [July 10, 2015, 11:07am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/7 "2015-07-10T11:07:09Z")
Hi Chris,
I don’t think you can change the native VLAN on the ASA, by default everything you send on the physical interface will be untagged and all sub-interfaces will be tagged (if you add a VLAN on it).
So there’s 3 ways to work around this:
1. Use the physical interface on the ASA for the native VLAN.
2. Configure the switch to tag the native VLAN.
3. Don’t use the native VLAN between the switch and ASA.
Rene
---
### Author:  [@r.grant3779](https://forum.networklessons.com/u/r.grant3779)
#### Post date: [July 12, 2015, 9:39pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/8 "2015-07-12T21:39:43Z")
Hi Rene,
In the design above would R1 be able to talk to R2 due to the security levels (70 going to an 80). Do Security level rules work the same for Sub Interfaces?
Thanks
Rob
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [July 13, 2015, 10:01am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/9 "2015-07-13T10:01:24Z")
Hi Rob,
That’s right, they work similar for sub-interfaces.
Rene
---
### Author:  [@r.grant3779](https://forum.networklessons.com/u/r.grant3779)
#### Post date: [July 13, 2015, 10:11am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/10 "2015-07-13T10:11:20Z")
Thanks Rene,
Just to confirm - If we wanted R1 to talk to R2, we would need an ACL?
Cheers
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [July 13, 2015, 10:17am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/11 "2015-07-13T10:17:37Z")
Hi Rob,
If you go from a high security level to a low security level then you won’t need an access-list. R1 will be able to reach R2, there’s no need to configure anything else. You could however restrict this with an access-list.
If you want to permit traffic from R2 to R1 then you’ll need an access-list since you go from a low to a higher security level.
Rene
---
### Author:  [@r.grant3779](https://forum.networklessons.com/u/r.grant3779)
#### Post date: [July 13, 2015, 10:36am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/12 "2015-07-13T10:36:26Z")
Hi Rene,
Is it not vice versa for your diagram above?
e.g
INSIDE1 which uses VLAN 10 and has a security level of 70 - Router 1
INSIDE2 which uses VLAN 20 and has a security level of 80. - Router 2
R1 to R2 would need AN ACL
R2 to R1 would not?
Or have I got the routers mixed up maybe.
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [July 13, 2015, 10:51am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/13 "2015-07-13T10:51:39Z")
You are totally right Rob…I mixed up those two routers 🙂 Time for another coffee here hehe.
---
### Author:  [@aaronbinnersley](https://forum.networklessons.com/u/aaronbinnersley)
#### Post date: [July 30, 2015, 1:21pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/14 "2015-07-30T13:21:24Z")
can the ASA participate in a VTP domain in transparent mode
so that it can share vlan info -
the link between the ASA and L3 switches need to be routed ports
ASA ---------------L3 SWITCH ------------------L3 SWITCH-------------ASA
trunk link TRUNK LINK
SWITCH SWITCH
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [July 30, 2015, 8:29pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/15 "2015-07-30T20:29:51Z")
Hi Aaron,
I’m afraid not, no VTP support for the ASA.
Rene
---
### Author:  [@aaronbinnersley](https://forum.networklessons.com/u/aaronbinnersley)
#### Post date: [August 26, 2015, 6:00pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/16 "2015-08-26T18:00:28Z")
hi
Is it best to configure inside interfaces with vlans as at the moment all I have configured on them is routing with an IP address assigned to each ?
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [August 26, 2015, 7:27pm UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/17 "2015-08-26T19:27:48Z")
Hi Aaron,
It really depends on what you are trying to achieve. If you have a small network then an INSIDE, DMZ and OUTSIDE zone might be all that you need. If you require more zones then you’ll need to use VLANs since the ASA doesn’t have that many interfaces.
Rene
---
### Author:  [@aaronbinnersley](https://forum.networklessons.com/u/aaronbinnersley)
#### Post date: [August 27, 2015, 10:05am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/18 "2015-08-27T10:05:48Z")
Hi
I have a stacked pair layer 3 switch configured with 6 SVI’s .
The firewall is connected to this with EIGRP routing enabled on all links ( inside and outside ) . All the firewall is doing at the moment is routing and filtering traffic before it hits the vlans
The firewall is then connected to a second pair of stacked switches . So why would I need to configure vlans on the firewall ?
stacked switch
ASA
Stacked switch ( ROUTED PORTS TOWARDS ASA )
( 6 SVI’S )
Thanks Rene , I appreciate your help
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [August 27, 2015, 11:25am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/19 "2015-08-27T11:25:03Z")
Hi Aaron,
There’s a couple of different options here. Right now you are using the switch for interVLAN routing, your ASA is only used when traffic from the VLANs leave your LAN and head out to the Internet. You don’t need anything else but an INSIDE and OUTSIDE on your ASA and that’s it. A static route (or routing protocol) on your switch to the ASA (and vice versa) and you are done. You can enforce some security between VLANs by using access-lists on your switch.
Now imagine you only have a layer 2 switch or perhaps you want some extra security between your VLANs…if this were the case then you could use the ASA for interVLAN routing. You would have to configure a trunk from the ASA to your switch and use sub-interfaces with VLANs in this scenario. I don’t recommend doing this for your LAN but it could be useful for your DMZ. Instead of having one big DMZ with all your servers you could break it down into multiple smaller DMZs and have traffic from server 1 in DMZ go through the ASA towards server 2 in DMZ 2 etc.
Hope this helps!
Rene
---
### Author:  [@aaronbinnersley](https://forum.networklessons.com/u/aaronbinnersley)
#### Post date: [September 21, 2015, 10:30am UTC](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824/20 "2015-09-21T10:30:49Z")
Hi Rene !
Need your experience !
Problem -
I have a stacked pair of layer 3 switches configured with 5 vlans
Also connected to the switches are a pair of ASA configured with HA
The stacked pair of switches are connected to a different site via fibre
Is there any need configure the connections to the ASA 's as trunk ports ? or is ok just to use static routes ?
Will there be 2 insides interfaces and 2 outside interfaces ?
I am happy with inside interfaces but will the outside interfaces connect to the stacked 3850’s configured with staitic routes ?
[Next page](https://forum.networklessons.com/t/cisco-asa-vlans-and-sub-interfaces/824.md?page=2)