Cisco 500 Series, Configuration Manual

Page: 83 / 1140

4-9
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 4 Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security Appliance
Configuring Switch Ports as Access Ports
Configuring Switch Ports as Access Ports
By default, all switch ports are shut down. To assign a switch port to one VLAN, configure it as an access
port. To create a trunk port to carry multiple VLANs, see the
“Configuring a Switch Port as a Trunk Port”
section on page 4-11 .
By default, the speed and duplex for switch ports are set to auto-negotiate. The default auto-negotiation
setting also includes the Auto-MDI/MDIX feature. Auto-MDI/MDIX eliminates the need for crossover
cabling by performing an internal crossover when a straight cable is detected during the auto-negotiation
phase. Either the speed or duplex must be set to auto-negotiate to enable Auto-MDI/MDIX for the
interface. If you explicitly set both the speed and duplex to a fixed value, thus disabling auto-negotiation
for both settings, then Auto-MDI/MDIX is also disabled.
Caution The ASA 5505 adaptive security appliance does not support Spanning Tree Protocol for loop detection
in the network. Therefore you must ensure that any connection with the adaptive security appliance does
not end up in a network loop.
To configure a switch port, perform the following steps:
Step 1
To specify the switch port you want to configure, enter the following command:
hostname(config)# interface ethernet0/ port
Where port is 0 through 7. For example, enter the following command:
hostname(config)# interface ethernet0/1
Step 2
To assign this switch port to a VLAN, enter the following command:
hostname(config-if)# switchport access vlan
number
Where number is the VLAN ID, between 1 and 4090.
Note
You might assign multiple switch ports to the primary or backup VLANs if the Internet access device
includes Layer 2 redundancy.
Step 3 (Optional) To prevent the switch port from communicating with other protected switch ports on the same
VLAN, enter the following command:
hostname(config-if)# switchport protected
You might want to prevent switch ports from communicating with each other if the devices on those
switch ports are primarily accessed from other VLANs, you do not need to allow intra-VLAN access,
and you want to isolate the devices from each other in case of infection or other security breach. For
example, if you have a DMZ that hosts three web servers, you can isolate the web servers from each other
if you apply the
switchport protected command to each switch port. The inside and outside networks
can both communicate with all three web servers, and vice versa, but the web servers cannot
communicate with each other.
Step 4 (Optional) To set the speed, enter the following command:
hostname(config-if)# speed { auto | 10 | 100 }