- last edited on by
ciscomoderator
would like to pass traffic to ASA first before inter vlan routing at 2901 router because I would like to control vlan 2 can access vlan 3 but
not allow vlan 3 to access vlan 2
2960 vlan 2 switch 1 ---> 2960 switch 0 ---> ASA ---> 2901 router 0 --> 2960 switch 0 ---> 2960 vlan 3 switch
1.how to let vlan 2 and vlan 3 traffic out from switch 0 Gig0/2 which is vlan 1 to ASA's vlan 1 in packettracer ?
2.is it possible there another traffic to go outside of ASA which means if ip address are public address then go outside, private ip address go inside by passing through the ASA and then do intervlan routing?
updated
if above is impossible, then when I set trunk port at ASA e0/2, it can not set trunk port, how can let vlan 2 and vlan 3 default gateway to this ASA in packet tracer?
juniper can use trunk port accept different vlan traffic, how do ASA do this?
conf t
int e0/2
switchport mode trunk
switchport trunk allowed vlan 1
switchport trunk allowed vlan add 2
switchport trunk allowed vlan add 3
shut
no shut
end
ciscoasa#conf t
ciscoasa(config)#int e0/2
ciscoasa(config-if)#switchport
% Incomplete command.
ciscoasa(config-if)#switchport ?
interface mode commands/options:
access Set access mode characteristics of the interface
ciscoasa(config-if)#switchport mode
^
% Invalid input detected at '^' marker.
conf t
hostname switch3
vlan dot1q tag native
end
conf t
vlan 2
vlan 3
end
conf t
int f0/1
switchport mode trunk
switchport trunk allowed vlan 2
switchport trunk allowed vlan add 3
no shut
end
conf t
int f0/2
switchport mode trunk
switchport trunk allowed vlan 3
switchport trunk allowed vlan add 2
no shut
end
conf t
int GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 2
switchport trunk allowed vlan add 3
switchport trunk allowed vlan add 5
no shut
end
conf t
ip default-gateway 192.168.5.254
end
spanning-tree vlan 1 priority 0
spanning-tree vlan 2 priority 0
spanning-tree vlan 3 priority 0
end
conf t
int vlan 2
ip address 192.168.2.3 255.255.255.0
no shut
end
conf t
int vlan 3
ip address 192.168.3.3 255.255.255.0
no shut
end
conf t
int vlan 5
ip address 192.168.5.3 255.255.255.0
shut
no shut
end
conf t
int vlan 1
ip address 192.168.5.9 255.255.255.0
shut
no shut
end
conf t
int GigabitEthernet0/2
switchport mode trunk
switchport trunk allowed vlan 1
shut
no shut
end
conf t
ip default-gateway 192.168.5.254
end
ASA
conf t
no dhcpd auto_config outside
no dhcpd address 192.168.1.5-192.168.1.36 inside
no dhcpd enable inside
end
conf t
int vlan 2
no ip address
end
conf t
int vlan 1
nameif inside
security 100
ip address 192.168.5.254 255.255.255.0
end
conf t
int e0/2
switchport access vlan 1
shut
no shut
end
conf t
int e0/1
switchport access vlan 1
shut
no shut
end
conf t
route inside 192.168.2.0 255.255.255.0 192.168.5.5
route inside 192.168.3.0 255.255.255.0 192.168.5.5
end
