About Physical Ports On The Asa 5505; About Vlans - Cisco ASA 5505 Getting Started Manual

Understanding VLANs on the ASA 5505

About Physical Ports on the ASA 5505

About VLANs

ASA 5505 Getting Started Guide
3-2
Maximum Number and Types of VLANs, page 3-3
•
The ASA 5505 has a built-in switch with eight Fast Ethernet ports, called switch
ports. Two of the eight physical ports are Power Over Ethernet (PoE) ports. You
can connect PoE ports directly to user equipment such as PCs, IP phones, or a
DSL modem. You can also connect to another switch. For more information, see
Ports and LEDs, page 4-9.
You can divide the eight physical ports into groups, called VLANs, that function
as separate networks. This enables you to improve the security of your business
because devices in different VLANs can only communicate with each other by
passing the traffic through the adaptive security appliance where relevant security
policies are applied.
The ASA 5505 comes preconfigured with two VLANs: VLAN1 and VLAN2. By
default, Ethernet switch port 0/0 is allocated to VLAN2. All other switch ports are
allocated by default to VLAN1.
Physical ports on the same VLAN communicate with each other using hardware
switching. VLANs communicate with each other using routes and bridges. For
example, when a switch port on VLAN1 is communicating with a switch port on
VLAN2, the adaptive security appliance applies configured security policies to
the traffic and routes or bridges the traffic between the two VLANs.
To impose strict access control and protect sensitive devices, you can apply
security policies to VLANs that restrict communications between VLANs. You
can also apply security policies to individual ports. You might want to apply
security policies at the port level if, for example, there are two ports on the same
VLAN connecting devices that you do not want to be able to communicate with
each other.
Before you can enable a switch port on the ASA 5505, it must be assigned to a
VLAN. With the Base platform, each switch port can be assigned to only one
VLAN at a time. With the Security Plus license, you can use a single port to trunk
between three VLANs on an external switch, enabling you to scale your
deployment for larger organizations.
Chapter 3 Planning a VLAN Configuration
78-18003-02