No Forward Interface Command on the Cisco ASA 5505 with a Base License

- September

2011

Posted By : Gom Jabbar

The ASA 5505 comes in two flavors: Base License and Security Plus license. Same hardware, but the Security Plus license unlocks more features, such as the number of VLANs that can be configured.

License Type and Mode	Maximum No. of Active VLANs	VLAN Trunking
Base License + Transparent Mode	2 active VLANs in 1 bridge group	Disabled
Base License + Routed Mode	3 active VLANs (3rd VLAN can initiate traffic to only one other VLAN)	Disabled
Security Plus License + Transparent Mode	3 active VLANs (2 active VLANs in 1 bridge group, plus 1 active VLAN for failover)	Enabled
Security Plus License + Routed Mode	20 active VLANs	Enabled

In this post, I am going to look how to configure a third VLAN on a Cisco ASA with a Base License, in Routed Mode. The first two VLANs can be configured to communicate with any of the other three VLANs. The third VLAN, however, can only be configured to initiate traffic with one other VLAN. So a good use for this third subnet would be as a DMZ or a guest subnet.

Let’s start with an unconfigured ASA 5505. Right out of the box, with a blank config. (You can also do a write erase and reload to wipe the config.)

Look at what the ASA’s default config contains. The only VLAN is VLAN1, and all the physical interfaces belong to it. VLAN1 and all the physical interfaces are administratively down. The show switch vlan command displays the VLANs and the physical ports assigned to each VLAN. The show interface ip brief command shows all physical and logical interfaces, their IP addresses, whether they are administratively up/down, and whether their line protocol is up/down.

ciscoasa# conf t
ciscoasa(config)# sh sw v
VLAN NameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  StatusÂ Â Â  Ports
---- -------------------------------- --------- -----------------------------
1Â Â Â  -Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  downÂ Â Â Â Â  Et0/0, Et0/1, Et0/2, Et0/3
                                                Et0/4, Et0/5, Et0/6, Et0/7

ciscoasa(config)# sh int ip b
InterfaceÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  IP-AddressÂ Â Â Â Â  OK? Method StatusÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Protocol
Internal-Data0/0Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Internal-Data0/1Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Loopback0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  127.1.0.1Â Â Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Vlan1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  downÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
Ethernet0/0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/4Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/5Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/6Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/7Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up

I’ll set up the first two VLANs as “inside” and “outside” and give them IP addresses.

ciscoasa(config)# int vlan1
ciscoasa(config-if)# ip add 5.5.5.1 255.255.255.0
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ciscoasa(config-if)# no shut
ciscoasa(config-if)# int vlan2
ciscoasa(config-if)# ip add 11.11.11.1 255.255.255.0
ciscoasa(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
ciscoasa(config-if)# no shut

However, when I try to do the same for VLAN3, the ASA coughs up an error at the point when I try to name VLAN3. This is because the ASA defines an active VLAN as a VLAN with a nameif command configured. So it will accept the IP address command, but not the nameif command on the third VLAN.

ciscoasa(config-if)# int vlan3
ciscoasa(config-if)# ip add 10.10.10.1 255.255.255.0
ciscoasa(config-if)# nameif dmz
ERROR: This license does not allow configuring more than 2 interfaces with
nameif and without a "no forward" command on this interface or on 1 interface(s)
with nameif already configured.

So I need to run the no forward interface vlan command before the ASA will allow me to name this third VLAN and thus enable it.

ciscoasa(config-if)# no forward interface vlan 1
ciscoasa(config-if)# nameif dmz
INFO: Security level for "dmz" set to 0 by default.
ciscoasa(config-if)# no shut

Now all three of the VLANs have names and IP addresses.

ciscoasa(config-if)# sh sw v
VLAN NameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  StatusÂ Â Â  Ports
---- -------------------------------- --------- -----------------------------
1Â Â Â  insideÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  downÂ Â Â Â Â  Et0/0, Et0/1, Et0/2, Et0/3
                                                Et0/4, Et0/5, Et0/6, Et0/7

2Â Â Â  outsideÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
3Â Â Â  dmzÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
ciscoasa(config-if)# sh int ip b
InterfaceÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  IP-AddressÂ Â Â Â Â  OK? Method StatusÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Protocol
Internal-Data0/0Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Internal-Data0/1Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Loopback0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  127.1.0.1Â Â Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Vlan1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  5.5.5.1Â Â Â Â Â Â Â Â  YES manual downÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
Vlan2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  11.11.11.1Â Â Â Â Â  YES manual downÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
Vlan3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  10.10.10.100Â Â Â  YES manual downÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
Ethernet0/0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/4Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/5Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/6Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/7Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up

All three VLANs are administratively up because I ran the no shut command when I configured them. However, their status is shown as down when I ran the show switch vlan command because they need to have at least one physical interface assigned to them, and that physical interface needs to be administratively up. You can see that all of the physical interfaces are administratively down. Four of the physical interfaces (E0/0, E0/1, E0/6 and E0/7) show their Line Protocol status as up. This is because those physical interfaces are connected to live devices on my network.

So let’s assign the physical interfaces to the VLANs and bring them up.

Ethernet 0/1 is already assigned to VLAN1, so all I have to do is run a no shut command. This brings Ethernet 0/1 up. Notice that VLAN1 also shows its status as up immediately.

ciscoasa(config-if)# int e0/1
ciscoasa(config-if)# no shut
ciscoasa(config-if)# sh sw v
VLAN Name                             Status    Ports
---- -------------------------------- --------- -----------------------------
1    inside                           up        Et0/0, Et0/1, Et0/2, Et0/3
                                                Et0/4, Et0/5, Et0/6, Et0/7

2    outside                          down
3    dmz                              down
ciscoasa(config-if)# sh int ip b
InterfaceÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  IP-AddressÂ Â Â Â Â  OK? Method StatusÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Protocol
Internal-Data0/0Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Internal-Data0/1Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Loopback0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  127.1.0.1Â Â Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Vlan1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  5.5.5.1Â Â Â Â Â Â Â Â  YES manual upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Vlan2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  11.11.11.1Â Â Â Â Â  YES manual downÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
Vlan3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  10.10.10.100Â Â Â  YES manual downÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  down
Ethernet0/0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Ethernet0/2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/4Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/5Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/6Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Ethernet0/7Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up

For a VLAN to be up, it needs:

An IP address and subnet mask
A name
A security level
To be administratively up
To have at least one physical interface assigned to it, and that physical interface must be up.

I’ll assign some of the other physical interfaces to VLAN2 and VLAN3.

ciscoasa(config-if)# int e0/0
ciscoasa(config-if)# switchport access vlan 2
ciscoasa(config-if)# no shut
ciscoasa(config-if)# int e0/6
ciscoasa(config-if)# switchport access vlan 3
ciscoasa(config-if)# no shut
ciscoasa(config-if)# int e0/7
ciscoasa(config-if)# switchport access vlan 3
ciscoasa(config-if)# no shut

Now all three VLANs are up.

ciscoasa(config-if)# sh sw v
VLAN NameÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  StatusÂ Â Â  Ports
---- -------------------------------- --------- -----------------------------
1Â Â Â  insideÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  upÂ Â Â Â Â Â Â  Et0/1, Et0/2, Et0/3, Et0/4
Et0/5
2Â Â Â  outsideÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  upÂ Â Â Â Â Â Â  Et0/0
3Â Â Â  dmzÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  upÂ Â Â Â Â Â Â  Et0/6, Et0/7
ciscoasa(config-if)# sh int ip b
InterfaceÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  IP-AddressÂ Â Â Â Â  OK? Method StatusÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â  Protocol
Internal-Data0/0Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Internal-Data0/1Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down up
Loopback0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  127.1.0.1Â Â Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Vlan1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  5.5.5.1Â Â Â Â Â Â Â Â  YES manual upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Vlan2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  11.11.11.1Â Â Â Â Â  YES manual upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Vlan3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  10.10.10.100Â Â Â  YES manual upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Ethernet0/0Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Ethernet0/1Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Ethernet0/2Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/3Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/4Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/5Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  administratively down down
Ethernet0/6Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up
Ethernet0/7Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  unassignedÂ Â Â Â Â  YES unsetÂ  upÂ Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  up

So how does the no forward interface vlan command affect the flow of traffic?

The inside interface can initiate traffic to the DMZ, and the return traffic is permitted. For example, a host on the inside network can access my web server in the DMZ. The inside host initiates the connection to my web server, and the ASA places the connection in its state table. When my web server replies with the web page, the ASA sees that this is not a new connection, just return traffic from an existing connection, and allows it to reach the inside host who had requested the web page.

However, the DMZ cannot initiate traffic to the inside interface, even when an ACL is configured on the dmz interface,Â explicitly permitting traffic from the DMZ to the inside. That is because the no forward interface vlan command prevents any traffic originating from the DMZ from entering the inside network.

So how is this different from the outside interface? After all, the outside interface has a security level of 0, and it cannot initiate traffic to the inside interface. However, since the outside interface does not have a no forward interface vlan command configured, an ACL on the outside interface is all you need to permit all traffic originating from the outside network to reach the inside network.