Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Configuration of V-lans

Hi, We have purchased a new HP L2 Switch and want to connect with Firewall. What is our requirment is mentioned below:

1) Create three V-Lan on L2 Swicth and connect with Firewall via single cable by making Trunk Port.

2) Want to implement ASA Failover which will also connect with switch.

Now I am being massive to think how its possible. Experts I would have your recommendation regarding Network upgradation.

Please suggest


Re: Configuration of V-lans


1) sure you can trunk between HP switch and ASA appliance as long HP switch supports 802.1q standard I m sure it does, simply configure L2 vlans in the switch and associate vlans with ASA subinterfaces which will be required for dot1q trunking. Depending on which ASA5500 model you will used will depend on how many vlans can the ASA support.

You can see this information in Virtual interfaces (VLANs) in this link

2) Absolutely, you can implement ASA failover through a single switch but be aware this is a single point of failure ( the switch ), you can use two switches down the road and connect switch1 to ASA1 and switch2 to ASA2 as well as configure a trunk between the switches.

Also be aware of what type of Failover support on ASA you will required, ALL ASA models support regular failover and statefull failover, exept ASA5505 does not support stateful failover.

If you need info on statefull see this link for details.

Your requirement is not to bad, just come up with a skect of requirements in terms of subnets, dmz's, wireless segments etc.. to then build your architecture.


PLS rate any helpful posts

New Member

Re: Configuration of V-lans

Thanks for your feedback.

Still some confusion!!!! I have make one V-lan (Vlan 100 Test) on FW and assigned IP and same V-lan has created on the L2 Switch. The same V-lan SVI is connected with FW Test V-lan Interface. The Switch IP is and which I can access when I connect switch default V-lan Interface after switching the FW connected cable from Test Vlan SVI to Def V-Lan Interface. Now qusetion is, why I am not able to access the swicth from my 12.1 Network even its connected on the same V-lan. Please suggest

Re: Configuration of V-lans

Im not sure I clearly understand , could PLS post sanatize ASA configuration to understand the flow.

Assuming you have created all L2 vlans in switch as well as respective logical sibinterfaces in asa , trunking in switch etc.. , in ASA to communicate between interfaces you need NAT functionality, as well as access control list depending on security levels you have assigned.

New Member

Re: Configuration of V-lans

Hi Jorge, I am very much understandable of provided your point's and am ready to go with that. As I have already cleared that we have HP L2 Switch which we will use it. Now what scenario I have drawn it, following mention:

VLAN Conf (100-NOC) ---IP Address (100 NOC) ---ETH 1-12.

Now when I connect my laptop with assigned IP with Switch port eth 1 then I must ping a machine Gateway which is which I am not able to do it.

I am very much sure ASA configuration is fine but I am not very confidence with configuration done on Switch. The attached file is a Switch configuration file for your reference. Please suggest….


CreatePlease to create content