Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Kind of a Cisco Luddite, but I'd like to assign physical switchports 0/1 and 0/2 to Vlan2 and physical switchports 0/3 and 0/4 to Vlan3. I'm assuming this is possible with base security license, i.e.:

!
interface Vlan1
 nameif outside
 security-level 0
 ip address 100.200.100.200 255.255.255.
  no shutdown
!
interface Vlan2
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0

!
interface Vlan3
 nameif dmz
 security-level 50
 ip address 10.0.1.1 255.255.255.0

!
interface Ethernet0/0
  switchport access vlan 1
!
interface Ethernet0/1
 switchport access vlan 2
!
interface Ethernet0/2
 switchport access vlan 2
!
interface Ethernet0/3
 switchport access vlan 3
!
interface Ethernet0/4
 switchport access vlan 3
!
share|improve this question
    
Yeah, that should work - though with the base license I think you'd need to have the traffic restriction where dmz can't initiate a connection to inside. Is it coughing up an error when you try to put that config in? –  Shane Madden Nov 2 '12 at 0:35
1  
I've not worked with an ASA but do you need to set "switchport mode access" on those ports? –  joeqwerty Nov 2 '12 at 0:35
    
I have not had a chance to play with it (it's in a data center right now), so I'm reaching out for a confident, resounding "yes" or "no" fellas :) –  gravyface Nov 2 '12 at 0:36
    
@joeqwerty from the live config, looks like it's just switchport access vlan1 (right now, just Ethernet0/1 is assigned to Vlan2; looking to add another port to each Vlan) –  gravyface Nov 2 '12 at 0:38

1 Answer 1

Yeah, that'll work just fine, though the base license will force you to restrict one of the interfaces:

interface Vlan3
 no forward interface Vlan2
share|improve this answer
    
Confoosed by what you mean by "restrict one of the interfaces". –  gravyface Nov 2 '12 at 2:07
1  
    
They must have the Security Plus license because right now, the 3 Vlan interfaces are all active and can pass traffic between each other (with appropriate ACLs). –  gravyface Nov 2 '12 at 11:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.