US Region

Grandmetric LLC
Lewes DE 19958
16192 Coastal Hwy USA
EIN: 98-1615498
+1 302 691 94 10

EMEA Region

ul. Metalowa 5, 60-118 Poznań, Poland
NIP 7792433527
+48 61 271 04 43


Grandmetric LTD
Office 584b
182-184 High Street North
E6 2JA
+44 20 3321 5276

  • en
  • pl
  • Cisco ASA: Subinterface config

    Design & Configure

    Cisco ASA: Subinterface config

    Technology: Network Security
    Area: Firewalls
    Vendor: Cisco
    Software: 8.X, 9.X
    Platform: Cisco ASA



    Ready to migrate from ASA to a supported firewall solution


    Most ASA models use routed ports for subinterface creation. To create a subinterface on a routed port, use a vlan tag for which the traffic will be landed and sourced (to and from a subinterface). On the physical port, the subinterface number must be defined. The rest configuration like nameif, security level and ip address still applies.

    Example of subinterface creation:

    ASA#configure terminal
    ASA(config)#interface GigabitEthernet1/4.10
    ASA(config-if)#vlan 10
    ASA(config-if)#nameif SRV
    ASA(config-if)#security-level 95
    ASA(config-if)#ip address

    ASA 5505 and 5506-X use switching physical ports thus the layer 3 interfaces are defined more like in switch with SVI interfaces. The example of L3 interface for ASA 5505 is given below.

    Assign a physical port to a vlan like you do for switches:

    ASA#configure terminal
    ASA(config)#interface Ethernet0/0
    ASA(config-if)#switchport access vlan 10

    Define the related Layer 3 interface and give it a necessary configuration:

    ASA#configure terminal
    ASA(config)#interface Vlan10
    ASA(config-if)#nameif inside
    ASA(config-if)#security-level 90
    ASA(config-if)#ip address


    Author: Marcin Bialy