Cisco FirePOWER ASA 5500 series Configuration Manual page 80

Configuring VLAN Interfaces
By default in routed mode, all VLANs use the same MAC address. In transparent mode, the VLANs use
unique MAC addresses. You might want to set unique VLANs or change the generated VLANs if your
switch requires it, or for access control purposes.
(Optional) To set an interface to management-only mode, enter the following command:
Step 8
hostname(config-if)# management-only
If this VLAN is your third VLAN, and you do not want to allow through traffic, you can limit
to-the-adaptive security appliance traffic using this command.
By default, VLAN interfaces are enabled. To enable the interface, if it is not already enabled, enter the
Step 9
following command:
hostname(config-if)# no shutdown
To disable the interface, enter the shutdown command.
The following example configures five VLAN interfaces. The fourth backup-isp interface only allows
through traffic when the primary interface is down. The fifth faillink VLAN interface is for failover.
hostname(config)# interface vlan 100
hostname(config-if)# nameif outside
hostname(config-if)# security-level 0
hostname(config-if)# ip address 10.1.1.1 255.255.255.0
hostname(config-if)# backup interface vlan 400
hostname(config-if)# no shutdown
hostname(config-if)# interface vlan 200
hostname(config-if)# nameif inside
hostname(config-if)# security-level 100
hostname(config-if)# ip address 10.2.1.1 255.255.255.0
hostname(config-if)# no shutdown
hostname(config-if)# interface vlan 300
hostname(config-if)# nameif dmz
hostname(config-if)# security-level 50
hostname(config-if)# ip address 10.3.1.1 255.255.255.0
hostname(config-if)# no shutdown
hostname(config-if)# interface vlan 400
hostname(config-if)# nameif backup-isp
hostname(config-if)# security-level 50
hostname(config-if)# ip address 10.1.2.1 255.255.255.0
hostname(config-if)# no shutdown
hostname(config-if)# failover lan faillink vlan500
hostname(config)# failover interface ip faillink 10.4.1.1 255.255.255.0 standby 10.4.1.2
255.255.255.0
hostname(config-if)# route outside 0 0 10.1.1.2 1
hostname(config)# route backup-isp 0 0 10.1.2.2 2
The following example configures three VLAN interfaces for the Base license. The third home interface
cannot forward traffic to the business interface.
hostname(config)# interface vlan 100
hostname(config-if)# nameif outside
hostname(config-if)# security-level 0
hostname(config-if)# ip address dhcp
hostname(config-if)# no shutdown
Cisco Security Appliance Command Line Configuration Guide
4-8
Chapter 4 Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security Appliance
OL-10088-01