US Region

Grandmetric LLC
Brookfield Place Office
200 Vesey Street
New York, NY 10281
EIN: 98-1615498
Phone: +1 302 691 94 10

EMEA Region

ul. Metalowa 5, 60-118 Poznań, Poland
NIP 7792433527
+48 61 271 04 43

Cisco ASA: Subinterface config

Design & Configure

Cisco ASA: Subinterface config

Technology: Network Security
Area: Firewalls
Vendor: Cisco
Software: 8.X, 9.X
Platform: Cisco ASA

Most ASA models use routed ports for subinterface creation. To create subinterface on routed port, use vlan tag for which the traffic will be landed and sourced (to and from subinterface). On physical port the subinterface number must be defined. The rest configuration like nameif, security leevel and ip address still applies.

Example of subinterface creation:

ASA#configure terminal
ASA(config)#interface GigabitEthernet1/4.10
ASA(config-if)#vlan 10
ASA(config-if)#nameif SRV
ASA(config-if)#security-level 95
ASA(config-if)#ip address

ASA 5505 and 5506-X use switching physical ports thus the layer 3 interfaces are defined more like in switch with SVI interfaces. The example of L3 interface for ASA 5505 is given below.

Assign physical port to a vlan like you do for switches:

ASA#configure terminal
ASA(config)#interface Ethernet0/0
ASA(config-if)#switchport access vlan 10

Define the related Layer 3 interface and give it necessary configuration:

ASA#configure terminal
ASA(config)#interface Vlan10
ASA(config-if)#nameif inside
ASA(config-if)#security-level 90
ASA(config-if)#ip address


Author: Marcin Bialy