The ASA 5505 comes in two flavors: Base License and Security Plus license. Same hardware, but the Security Plus license unlocks more features, such as the number of VLANs that can be configured.
| License Type and Mode | Maximum No. of Active VLANs | VLAN Trunking |
| Base License + Transparent Mode | 2 active VLANs in 1 bridge group | Disabled |
| Base License + Routed Mode | 3 active VLANs (3rd VLAN can initiate traffic to only one other VLAN) |
Disabled |
| Security Plus License + Transparent Mode | 3 active VLANs (2 active VLANs in 1 bridge group, plus 1 active VLAN for failover) |
Enabled |
| Security Plus License + Routed Mode | 20 active VLANs | Enabled |
In this post, I am going to look how to configure a third VLAN on a Cisco ASA with a Base License, in Routed Mode. The first two VLANs can be configured to communicate with any of the other three VLANs. The third VLAN, however, can only be configured to initiate traffic with one other VLAN. So a good use for this third subnet would be as a DMZ or a guest subnet.
Let’s start with an unconfigured ASA 5505. Right out of the box, with a blank config. (You can also do a write erase and reload to wipe the config.)
Look at what the ASA’s default config contains. The only VLAN is VLAN1, and all the physical interfaces belong to it. VLAN1 and all the physical interfaces are administratively down. The show switch vlan command displays the VLANs and the physical ports assigned to each VLAN. The show interface ip brief command shows all physical and logical interfaces, their IP addresses, whether they are administratively up/down, and whether their line protocol is up/down.
ciscoasa# conf t
ciscoasa(config)# sh sw v
VLAN Name Status Ports
---- -------------------------------- --------- -----------------------------
1 - down Et0/0, Et0/1, Et0/2, Et0/3
Et0/4, Et0/5, Et0/6, Et0/7
ciscoasa(config)# sh int ip b
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset administratively down up
Loopback0 127.1.0.1 YES unset up up
Vlan1 unassigned YES unset down down
Ethernet0/0 unassigned YES unset administratively down up
Ethernet0/1 unassigned YES unset administratively down up
Ethernet0/2 unassigned YES unset administratively down down
Ethernet0/3 unassigned YES unset administratively down down
Ethernet0/4 unassigned YES unset administratively down down
Ethernet0/5 unassigned YES unset administratively down down
Ethernet0/6 unassigned YES unset administratively down up
Ethernet0/7 unassigned YES unset administratively down up
I’ll set up the first two VLANs as “inside” and “outside” and give them IP addresses.
ciscoasa(config)# int vlan1 ciscoasa(config-if)# ip add 5.5.5.1 255.255.255.0 ciscoasa(config-if)# nameif inside INFO: Security level for "inside" set to 100 by default. ciscoasa(config-if)# no shut ciscoasa(config-if)# int vlan2 ciscoasa(config-if)# ip add 11.11.11.1 255.255.255.0 ciscoasa(config-if)# nameif outside INFO: Security level for "outside" set to 0 by default. ciscoasa(config-if)# no shut
However, when I try to do the same for VLAN3, the ASA coughs up an error at the point when I try to name VLAN3. This is because the ASA defines an active VLAN as a VLAN with a nameif command configured. So it will accept the IP address command, but not the nameif command on the third VLAN.
ciscoasa(config-if)# int vlan3 ciscoasa(config-if)# ip add 10.10.10.1 255.255.255.0 ciscoasa(config-if)# nameif dmz ERROR: This license does not allow configuring more than 2 interfaces with nameif and without a "no forward" command on this interface or on 1 interface(s) with nameif already configured.
So I need to run the no forward interface vlan command before the ASA will allow me to name this third VLAN and thus enable it.
ciscoasa(config-if)# no forward interface vlan 1 ciscoasa(config-if)# nameif dmz INFO: Security level for "dmz" set to 0 by default. ciscoasa(config-if)# no shut
Now all three of the VLANs have names and IP addresses.
ciscoasa(config-if)# sh sw v
VLAN Name Status Ports
---- -------------------------------- --------- -----------------------------
1 inside down Et0/0, Et0/1, Et0/2, Et0/3
Et0/4, Et0/5, Et0/6, Et0/7
2 outside down
3 dmz down
ciscoasa(config-if)# sh int ip b
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset administratively down up
Loopback0 127.1.0.1 YES unset up up
Vlan1 5.5.5.1 YES manual down down
Vlan2 11.11.11.1 YES manual down down
Vlan3 10.10.10.100 YES manual down down
Ethernet0/0 unassigned YES unset administratively down up
Ethernet0/1 unassigned YES unset administratively down up
Ethernet0/2 unassigned YES unset administratively down down
Ethernet0/3 unassigned YES unset administratively down down
Ethernet0/4 unassigned YES unset administratively down down
Ethernet0/5 unassigned YES unset administratively down down
Ethernet0/6 unassigned YES unset administratively down up
Ethernet0/7 unassigned YES unset administratively down up
All three VLANs are administratively up because I ran the no shut command when I configured them. However, their status is shown as down when I ran the show switch vlan command because they need to have at least one physical interface assigned to them, and that physical interface needs to be administratively up. You can see that all of the physical interfaces are administratively down. Four of the physical interfaces (E0/0, E0/1, E0/6 and E0/7) show their Line Protocol status as up. This is because those physical interfaces are connected to live devices on my network.
So let’s assign the physical interfaces to the VLANs and bring them up.
Ethernet 0/1 is already assigned to VLAN1, so all I have to do is run a no shut command. This brings Ethernet 0/1 up. Notice that VLAN1 also shows its status as up immediately.
ciscoasa(config-if)# int e0/1
ciscoasa(config-if)# no shut
ciscoasa(config-if)# sh sw v
VLAN Name Status Ports
---- -------------------------------- --------- -----------------------------
1 inside up Et0/0, Et0/1, Et0/2, Et0/3
Et0/4, Et0/5, Et0/6, Et0/7
2 outside down
3 dmz down
ciscoasa(config-if)# sh int ip b
Interface IP-Address OK? Method Status Protocol
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset administratively down up
Loopback0 127.1.0.1 YES unset up up
Vlan1 5.5.5.1 YES manual up up
Vlan2 11.11.11.1 YES manual down down
Vlan3 10.10.10.100 YES manual down down
Ethernet0/0 unassigned YES unset administratively down up
Ethernet0/1 unassigned YES unset up up
Ethernet0/2 unassigned YES unset administratively down down
Ethernet0/3 unassigned YES unset administratively down down
Ethernet0/4 unassigned YES unset administratively down down
Ethernet0/5 unassigned YES unset administratively down down
Ethernet0/6 unassigned YES unset administratively down up
Ethernet0/7 unassigned YES unset administratively down up
For a VLAN to be up, it needs:
- An IP address and subnet mask
- A name
- A security level
- To be administratively up
- To have at least one physical interface assigned to it, and that physical interface must be up.
I’ll assign some of the other physical interfaces to VLAN2 and VLAN3.
ciscoasa(config-if)# int e0/0 ciscoasa(config-if)# switchport access vlan 2 ciscoasa(config-if)# no shut ciscoasa(config-if)# int e0/6 ciscoasa(config-if)# switchport access vlan 3 ciscoasa(config-if)# no shut ciscoasa(config-if)# int e0/7 ciscoasa(config-if)# switchport access vlan 3 ciscoasa(config-if)# no shut
Now all three VLANs are up.
ciscoasa(config-if)# sh sw v VLAN Name Status Ports ---- -------------------------------- --------- ----------------------------- 1 inside up Et0/1, Et0/2, Et0/3, Et0/4 Et0/5 2 outside up Et0/0 3 dmz up Et0/6, Et0/7 ciscoasa(config-if)# sh int ip b Interface IP-Address OK? Method Status Protocol Internal-Data0/0 unassigned YES unset up up Internal-Data0/1 unassigned YES unset administratively down up Loopback0 127.1.0.1 YES unset up up Vlan1 5.5.5.1 YES manual up up Vlan2 11.11.11.1 YES manual up up Vlan3 10.10.10.100 YES manual up up Ethernet0/0 unassigned YES unset up up Ethernet0/1 unassigned YES unset up up Ethernet0/2 unassigned YES unset administratively down down Ethernet0/3 unassigned YES unset administratively down down Ethernet0/4 unassigned YES unset administratively down down Ethernet0/5 unassigned YES unset administratively down down Ethernet0/6 unassigned YES unset up up Ethernet0/7 unassigned YES unset up up
So how does the no forward interface vlan command affect the flow of traffic?
The inside interface can initiate traffic to the DMZ, and the return traffic is permitted. For example, a host on the inside network can access my web server in the DMZ. The inside host initiates the connection to my web server, and the ASA places the connection in its state table. When my web server replies with the web page, the ASA sees that this is not a new connection, just return traffic from an existing connection, and allows it to reach the inside host who had requested the web page.
However, the DMZ cannot initiate traffic to the inside interface, even when an ACL is configured on the dmz interface, explicitly permitting traffic from the DMZ to the inside. That is because the no forward interface vlan command prevents any traffic originating from the DMZ from entering the inside network.
So how is this different from the outside interface? After all, the outside interface has a security level of 0, and it cannot initiate traffic to the inside interface. However, since the outside interface does not have a no forward interface vlan command configured, an ACL on the outside interface is all you need to permit all traffic originating from the outside network to reach the inside network.
Additional Information:
write erase command in the Cisco ASA 8.4 and 8.5 Command Reference.
reload command in the Cisco ASA 8.4 and 8.5 Command Reference.
switchport access command in the Cisco ASA 8.4 and 8.5 Command Reference.
show switch vlan command in the Cisco ASA 8.4 and 8.5 Command Reference.
show interface ip brief command in the Cisco ASA 8.4 and 8.5 Command Reference.
nameif command in the Cisco ASA 8.4 and 8.5 Command Reference.
ip address command in the Cisco ASA 8.4 and 8.5 Command Reference.
forward interface command in the Cisco ASA 8.4 and 8.5 Command Reference.
shutdown command in the Cisco ASA 8.4 and 8.5 Command Reference.