1 2 Previous Next 26 Replies Latest reply: Oct 28, 2015 9:32 AM by siracuse RSS

5506-x no switch option as 5505?

leo.espinosa

Just bought a new ASA 5506-x to play with it, and found out the 8 ports cannot be configured as a switch in the same way we do with ASA5505.

 

There are any option to use the remaining ports as a switch?

  • 1. Re: 5506-x no switch option as 5505?
    brremmel

    Unlike ASA5505, ASA5506-X does not support switch ports at this time.

  • 2. Re: 5506-x no switch option as 5505?
    sander.magnin

    Hi Brian, are you Cisco Employee? Do you know the timeframe when support is coming. The 5506 is the successor of the 5505. Pretty weird if you don't get the same (essential)  features in the new hardware.

  • 3. Re: 5506-x no switch option as 5505?
    brremmel

    Hi Sander,

     

    Yes, I am a Cisco employee. I'm investigating this and will get back to you.

     

    Thanks,

    Brian

  • 4. Re: 5506-x no switch option as 5505?
    Clockworthy

    This is a pretty big miss on Cisco's side.  How is this supposed to be a replacement for the Cisco ASA 5505?

     

    Is there an ETA for when the switch port feature will be available for the ASA 5506X?

  • 5. Re: 5506-x no switch option as 5505?
    jessiestarns

    HI,

     

    Is there an update on this? This is a pretty big mess for everyone that was expecting to be able to use the 5506 the same way as the 5505.

     

    Thanks,5506-x no switch option as 5505?

  • 6. Re: 5506-x no switch option as 5505?
    tmcarter@ultrastat.com

    Brian:

     

    I respectfully have to disagree...

     

    Its all in a matter of knowing how to maneuver around the various options and the lack of youtube videos and config examples for real world configs  are very challenging here, to say the lease..

     

    This is a very simple accomplishment that will group all the ports into a logical switch and assign each port to a group..  We will be using a concept of etherchannels or port-channels as Cisco defines them...  Here is the example.

     

     

    NOT GROUPED GROUPED
    interface GigabitEthernet1/1 interface GigabitEthernet1/1
    nameif outside nameif outside
    security-level 0 security-level 0
    ip address 1.1.1.1 255.255.255.0 ip address 1.1.1.1 255.255.255.0
    ! !
    interface GigabitEthernet1/2 interface GigabitEthernet1/2
    nameif inside no nameif
    security-level 100 no security-level
    ip address 192.168.1.1 255.255.255.0 no ip address
    ! !
    interface GigabitEthernet1/3 interface GigabitEthernet1/3
    no nameif channel-group 1 mode active
    no security-level no nameif
    no ip address no security-level
    ! no ip address
    interface GigabitEthernet1/4 !
    no nameif interface GigabitEthernet1/4
    no security-level channel-group 1 mode active
    no ip address no nameif
    ! no security-level
    interface GigabitEthernet1/5 no ip address
    no nameif !
    no security-level interface GigabitEthernet1/5
    no ip address channel-group 1 mode active
    ! no nameif
    interface GigabitEthernet1/6 no security-level
    no nameif no ip address
    no security-level !
    no ip address interface GigabitEthernet1/6
    ! channel-group 1 mode passive
    interface GigabitEthernet1/7 no nameif
    no nameif no security-level
    no security-level no ip address
    no ip address !
    ! interface GigabitEthernet1/7
    interface GigabitEthernet1/8 channel-group 1 mode passive
    no nameif no nameif
    no security-level no security-level
    no ip address no ip address
    ! !
    interface Management1/1 interface GigabitEthernet1/8
    management-only no nameif
    nameif management no security-level
    security-level 100 no ip address
    ip address 192.168.15.13 255.255.255.0 !
    interface Management1/1
    management-only
    nameif management
    security-level 0
    ip address 192.168.15.13 255.255.255.0
    !
    interface Port-channel1
    lacp max-bundle 8
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0

     

     

    As you can see the column labeled "Grouped" will arrange all the specified ports into a LACP etherport channel group, logically creating two separate segments, much like a VLAN; however there are substantial other config items that must be configured in order for this to work successfully; however it will work and function as a L2 switch, just as described...

     

    I will post more examples and comments as I come across issues that plague me as well...

     

    I would suggest instead of saying the latest ASA5506-X does not support switch ports or "X" you may want to fully investigate the broad range of options available to the resource users... Lack of knowledge doesn't constitute the intended use of product support.

     

    There is not much this robust ASA5506-X platform can not do, given, time, patience and the willingness to not rely on a point and click solution.

     

    Our company will be glad to support any users on this platform, of course for a small fee.. Please feel free to reach out with your request and we can move forward... This is a great and rocksolid brand new product; which WILL REQUIRE relearning some basic 5505 mentality; but again.. no videos, docs or real world examples are available yet...  I think this is probably the first of many to come...

     

    Regards,

     

     

     

    Ty Carter, President

    Strategic Network Consultants, Inc.

    524 East 9th Street

    Washington, NC  27889

     

  • 7. Re: 5506-x no switch option as 5505?
    leo.espinosa

    Etherchannels will work when you connect the new ASA 5506 to another switch. A matter of adapt, i agree.

     

    However, when no switch around, and you see this often in small remote offices/ soho (4-5 devices), what are you going to do?

     

    Are you going to ask the customer to buy a switch for that??? no good.

     

    The ASA 5505 was cheap, simple and it worked perfect.

     

    To Cisco: If it ain't broke, don't fix it

  • 8. Re: 5506-x no switch option as 5505?
    tmcarter@ultrastat.com

    I don’t believe you have to attach the device to another switch… The IOS will create its own grouping internally…  I am going to put this to the test tomorrow…

     

    I agree wholeheartedly it is a definite change in dynamic; but that was not the question posed here… I didn’t say I liked it any more than the next person.

     

    We will see where this takes us.. at least this is according to TAC group.

  • 9. Re: 5506-x no switch option as 5505?
    Clockworthy

    Here is the information I got from the Partner Virtual Team Support group.

     

    Q. We just got our first ASA 5506 and found out that we cannot configure VLAN interface on it like the 5505.

        This is a big problem if we are trying to position the 5506 as a replacement for the 5505.

        ...

       Can you look into when/if this feature is going to be available?

     

    A. The ASA5506 does not have switch ports as the old ASA5506. The ASA5506 is similar to the ASA5512 and 5515 from a

         configuration perspective.

        Based on our internal resources, for now there are no plans to implement switch ports on the ASA5506.

     

    Q. Can you explain why this is not a feature of the ASA 5506?

     

    A. Because the ASA5506-X includes all routed ports, there is currently no built-in switch capabilities like the ASA5505. Each port can be use as a WAN port.

  • 10. Re: 5506-x no switch option as 5505?
    matt.king@ggr.net

    HI All

     

    I am in a bit of a fix with this too. Some of the 5506-X links are connected to servers, PC's and printers in my case. I have been trying to find a way to get the 6 spare ports working as switchports. I have configured a Port-Channel which is up and showing ports as bundled. This appears to work only intermittently, some pings work some don't. I get arp for hosts but can't ping them so need to look at further.

     

    I used Channel-group 1 mode on to force the Port-Channel up as I will get no lacp or pagp from anywhere and the Port-Channel interface showed as down with any other mode, as expected.

     

    I will know more tomorrow as our customer is going to see what connectivity is like first thing.....

     

    Not great though, already been caught out by the lack of POE, now a SOHO device will not do switchports. Maybe its not a SoHo device?

  • 11. Re: 5506-x no switch option as 5505?
    jessiestarns

    So we had a call with Cisco yesterday concerning this new 5506 and asked them some very direct questions:

     

    Q: We currently use the 5505 as a SOHO solution using EZVPN with a pair of 5525's at the head-end. Will the 5506's work? Keep in mind that we use these as a primary means of connectivity for home users that have dynamic ip addresses.

     

    A: Yes, if the 5506 has a static ip address it will work with the 5525 via a s2s tunnel. (not feasible for us) If they are using dynamic ip addresses, these will not work.

     

    Then Cisco recommended we checkout the Meraki line of new stuff: meraki.cisco.com. (basically a new solution for SOHO I gathered).

     

    Basically, we asked them about of EOL/EOS for the 5505 and they couldn't/wouldn't tell us. It basically just screws us with the investment we've made in the last year with the 5505's.

     

    We're not happy, not happy at all.

  • 12. Re: 5506-x no switch option as 5505?
    matthew.hall@adiit.com

    Yeah...using LACP is not a solution, I would never try and hack that together for a production system....not to mention it won't work correctly due to LACP load balancing issues.

     

    This lack of switch ports is doubly bad for those users who are using 5505 with switchports as a soho in a box. 

     

    You can use the 5506 using aggressive mode tunnels as a replacement for ezvpn (it's aggressive mode), but you lose the group key...I guess ikev2 is maybe an ok alternative as it uses asynchronous preshared keys.

     

    No switch as stated means cisco can sell you another box.  Especially since it has no POE.

     

    Meraki...this means a whole new infrastructure (more sales) and it also means no POE.  This effectively means Cisco doesn't have SOHO solution with built in POE anymore.  This is a huge pain if you are using a 5505 to drive a phone and wireless AP...Especially if the AP is distant remote...basically, yes another thing to buy (POE injector).

  • 13. Re: 5506-x no switch option as 5505?
    dkingfx00

    Do we know if this is software limitation or both software and hardware?

  • 14. Re: 5506-x no switch option as 5505?
    v-chrisi@watermark-llc.com

    Hi Ty-

     

    Have you actually tested this with a PC connected to a channel-group1 port?

     

    I have this setup in the lab and ran into the same issues as everyone else. We use the 5505 as a one box solution and this forces us to buy a second switch which kills our design and increases our points of failure not to mention Smartnet fees for two devices. I thought maybe your solution would work for us but I am unable to receive an address via DHCP. We use the ASA for DHCP and when I try to configure the port-channel we never receive an address. Once I remove the port-channel and use a physical interface the ASA assigns the DHCP address no problem. I'm wondering if this was a solution in theory or if it has actually been vetted.

1 2 Previous Next