The inside interface on our 515 FW ver 6.3(1) has IP address of 172.20.20.2. We have also a catalyst switch configured for two vlans, 172.20.20.x (vlan20) & 172.20.21.x (vlan21). The inside interface of the PIX is connected to a port on the switch configured for vlan 20. Question is... do I have to configure that catalys switch port, connecting the inside intf of the pix, as a trunk port with encapsulation dot1q for the pix to accept both vlan 20 and 21 data?
You have not provided us with the type of catalyst switch. If this is a layer-3 type switch and you are allready routing on this layer-3 switch, you have to do nothing else then what you allready connect (okay, besides setting the default route on your layer-3 switch, pointing to the PIX)
What I´m curious about is where did your routing took place for traffic between this two vlan´s before the PIX was installed? The answer to that question answers also your own question I´ll guess.
If you have no routing between the two vlan´s in the old situation, and you want both vlan´s to communicate trough the pix, you indeed have to connect both vlan´s to the PIX. From version 6.3.1 I believe it is possible to use 802.1q trunk to a PIX, but I´ll have to check this.
Hope this helps, otherwise please provide more detail about your setup, and what you try to achieve, cause this will hep answer your question.
Not exactly sure the other fella that answered your question was talking about, but in my opinion the answer to both of your questions is "yes". You need to configure the switch port as a dot1q trunk and trunk vlans 20 and 21. Use a vlan other than 20 or 21 as the native vlan for this switch port - use vlan 1 - and then don't trunk the native vlan. Packets on the native vlan are untagged and could possibly present some security vulnerabilities. Switch config:
set vlan 1
clear trunk 1-1005
set trunk on dot1q 20,21
set port channel mode off
set spantree portfast enable
set port speed 100
set port duplex full
You also need to configure vlans on your PIX. (Which is an awesome feature. Now all cisco needs to do is enable the PIX to do QoS..) Here's the config for your PIX (i'm assuming that ethernet1 is your inside intf):
interface ethernet1 100full
interface ethernet1 vlan20 physical
interface ethernet1 vlan21 logical
nameif ethernet1 inside security50
nameif vlan21 OtherVLAN security50
ip address inside 172.20.20.ddd 255.255.255.0
ip address OtherVLAN 172.20.21.ddd 255.255.255.0
That should be all you need to get the PIX to forward traffic from both vlans. Hope this helps!
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...