Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Connect ASA to VLAN switch for a DMZ?

Hi, I have a ASA 5520 and a Cisco 3560 switch. I want to create a couple of DMZ/VLANs on the switch to house some web servers on one and the other will be for testing. I have created the 2 vlans (I think) on the switch:



VLAN1 seems to be the global VLAN for the switch or something else, am I right?

I have connect port 1 on the switch to 0/2 on the ASA. I will add the routes on the LAN to point to the ASA for these 2 networks, but what else do I need to do? Do I have to trunk the 2 and tell the ASA about these 2 VLAN's somehow?



Re: Connect ASA to VLAN switch for a DMZ?

Hi ..

Yes you need to configure a trunk between the port connected to the 0/2 port on the ASA and the switch. The port on the ASA needs to be configured with virtual interfaces. For example you will need to use the command

interface gigabitethernet 0/2.2

vlan 2

no shut

ip address x.x.x.x

interface gigabitethernet 0/2.3

vlan 3

no shut

ip address x.x.x.x

The above will create a trunk on gigabitethernet 0/2 for VLANs 2 and 3. You also need to allocate an IP address, name and security level to each subinterface. The following link might give you an idea.

I hope it helps .. please rate it if it does !!!

Community Member

Re: Connect ASA to VLAN switch for a DMZ?

Thanks, just picked this up. What would I need to do on the trunk port on the switch side?

Community Member

Re: Connect ASA to VLAN switch for a DMZ?

switchport trunk encapsulation dot1q

switchport mode trunk

CreatePlease to create content