US Region

Grandmetric LLC
Brookfield Place Office
200 Vesey Street
New York, NY 10281
EIN: 98-1615498
+1 302 691 94 10

EMEA Region

ul. Metalowa 5, 60-118 Poznań, Poland
NIP 7792433527
+48 61 271 04 43

  • en
  • pl
  • Cisco ASA: Subinterface config

    Design & Configure

    Cisco ASA: Subinterface config

    Technology: Network Security
    Area: Firewalls
    Vendor: Cisco
    Software: 8.X, 9.X
    Platform: Cisco ASA


    ASA migration options


    Most ASA models use routed ports for subinterface creation. To create subinterface on routed port, use vlan tag for which the traffic will be landed and sourced (to and from subinterface). On physical port the subinterface number must be defined. The rest configuration like nameif, security level and ip address still applies.

    Example of subinterface creation:

    ASA#configure terminal
    ASA(config)#interface GigabitEthernet1/4.10
    ASA(config-if)#vlan 10
    ASA(config-if)#nameif SRV
    ASA(config-if)#security-level 95
    ASA(config-if)#ip address

    ASA 5505 and 5506-X use switching physical ports thus the layer 3 interfaces are defined more like in switch with SVI interfaces. The example of L3 interface for ASA 5505 is given below.

    Assign physical port to a vlan like you do for switches:

    ASA#configure terminal
    ASA(config)#interface Ethernet0/0
    ASA(config-if)#switchport access vlan 10

    Define the related Layer 3 interface and give it necessary configuration:

    ASA#configure terminal
    ASA(config)#interface Vlan10
    ASA(config-if)#nameif inside
    ASA(config-if)#security-level 90
    ASA(config-if)#ip address


    Author: Marcin Bialy