Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VLANs on PIX 515E


I am trying to configure a PIX 515E unit with multiple VLANs (each VLAN for each client traffic). I have 2 /29 networks from my ISP and I want to use each IP to each client for their outgoing and incoming traffic. so each client traffic will be natted to a public IP for outgoing and incoming traffic

I would like to know how can I configure these IPs (2 different range /29 networks) on the pix unit as it doesnt accept secondary IPs as on the router.

To configure VLANs, can I just use eth 0/1 for the inside network and configure into sub interfaces?

Any advise on this is much appreciated and also any links for the configuration would be helpful.

I am using other brand routers now and having a terrible outage which seems hard to point the issue for the vendor as well. So I am planning to upgrade to the PIX unit.



Re: VLANs on PIX 515E

in this case u can use ur firewall with multiple context

so that eachinterface can be in a diffent context or each subinterface be i diffrent context thus u will have two saparate firtual firewalls each one with its own config like IPs, nating access policies and so on

but with multiple context mode u cant do VPN !!

also u can use shared outside interface or sapart physycal or subinterfaces for each context

have a look at the followin config example:

Enabling Multiple Context Mode

good luck

if helpful Rate

New Member

Re: VLANs on PIX 515E


I think I need the license for multiple context right? I dont have one right now. Is there anyway to achieve this without contexts?


Re: VLANs on PIX 515E

go to subinterfaces then

New Member

Re: VLANs on PIX 515E


I have created sub interfaces to do trunking with my Adtran switch. I think the trunking is not happening properly.

interface Ethernet1

description "Trunk Connectivity to Switch"

no nameif

no security-level

no ip address


interface Ethernet1.1

vlan 1

nameif inside

security-level 100

ip address


interface Ethernet1.2

vlan 100

nameif DMZ2

security-level 90

ip address


interface Ethernet1.3

vlan 35

nameif DMZ3

security-level 90

ip address


interface Ethernet1.4

vlan 36

nameif DMZ4

security-level 90

ip address


switch config

int eth 0/24

switchport mode trunk

switchport trunk native vlan 400

can ping all the VLAN IPs from the PIX itself

can ping the and the switch from the pc but not any other vlans

can ping from the switch but not any other vlans

cannot ping the switch from the pix

cannot ping the pc on vlan1 from the pix

I created the layer 2 vlans on the switch and assigned ports on the vlans

ip default gateway

switchport trunk native vlan 400 - I had to add this command as Adtran mentioned that PIX is not seeing the vlan1 as native vlan1. If I dont add this there are no pings from anywhere.

Please help me ASAP as my network is down. I tried the same with a Netgear switch and the same issue


Re: VLANs on PIX 515E

i think the problem on the switch side now

first u have put the native vlan as 400

so that mean only vlan 400 will be passed through the trunk link as untaged which is by defualt vlan 1

so if u use vlan 1 and make sure the trunk encapsulation on the switch side it dot1q

if u wanna reach vlan one make the native

also for communication between vlans there is two ways

now based on ur config the communication between vlans must be through the firewall

so on the sitch done creat a SVI i mean vlan interface but just creat vlans corsponding to those on the firewall subinterfaces

and make each PC defual gatway as the firewall IP in the corspondin vlan number

as long as u have interfaces have same security level u need to put the command permit inra-same-securty somthing not surabout the syntax but to allow communicationbetween interface has the same sec level

but about vlan 1 did u created and SVI for it ?