Cisco ASA 5505 Configuration Manual page 248

Starting Interface Configuration (ASA 5505)
Detailed Steps
Choose the Configuration > Device Setup > Interfaces pane.
Step 1
Click the Switch Ports tab.
Step 2
Click the switch port you want to edit.
Step 3
The Edit Switch Port dialog box appears.
To enable the switch port, check the Enable SwitchPort check box.
Step 4
In the Mode and VLAN IDs area, click the Trunk radio button.
Step 5
Step 6 In the VLAN IDs field, enter the VLAN IDs associated with this switch port, separated by commas. The
VLAN ID can be between 1 and 4090.
You can include the native VLAN in this field, but it is not required; the native VLAN is passed whether
it is included in this field or not.
This switch port cannot pass traffic until you assign at least one VLAN to it, native or non-native.
If the VLANs are already in your configuration, after you apply the change, the Configuration > Device
Setup > Interfaces > Interfaces tab shows this switch port added to each VLAN. If you want to specify
a VLAN that has not yet been added, we suggest you add the VLAN according to the
VLAN Interfaces" section on page 8-17
need to add the VLAN according to the
the switch port to it.
Step 7 To configure the native VLAN, check the Configure Native VLAN check box, and enter the VLAN ID
in the Native VLAN ID field. The VLAN ID can be between 1 and 4090.
Packets on the native VLAN are not modified when sent over the trunk. For example, if a port has
VLANs 2, 3 and 4 assigned to it, and VLAN 2 is the native VLAN, then packets on VLAN 2 that egress
the port are not modified with an 802.1Q header. Frames which ingress (enter) this port and have no
802.1Q header are put into VLAN 2.
Each port can only have one native VLAN, but every port can have either the same or a different native
VLAN.
(Optional) To prevent the switch port from communicating with other protected switch ports on the same
Step 8
VLAN, check the Isolated check box.
This option prevents the switch port from communicating with other protected switch ports on the same
VLAN. You might want to prevent switch ports from communicating with each other if the devices on
those switch ports are primarily accessed from other VLANs, you do not need to allow intra-VLAN
access, and you want to isolate the devices from each other in case of infection or other security breach.
For example, if you have a DMZ that hosts three web servers, you can isolate the web servers from each
other if you apply the Protected option to each switch port. The inside and outside networks can both
communicate with all three web servers, and vice versa, but the web servers cannot communicate with
each other.
Step 9 (Optional) From the Duplex drop-down list, choose Full, Half, or Auto.
The Auto setting is the default. If you set the duplex to anything other than Auto on PoE ports Ethernet
0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will
not be detected and supplied with power.
(Optional) From the Speed drop-down list, choose 10, 100, or Auto.
Step 10
The Auto setting is the default. If you set the speed to anything other than Auto on PoE ports Ethernet
0/6 or 0/7, then Cisco IP phones and Cisco wireless access points that do not support IEEE 802.3af will
not be detected and supplied with power.
Cisco ASA 5500 Series Configuration Guide using ASDM
8-20
rather than specifying it in this dialog box; in either case, you
"Configuring VLAN Interfaces" section on page 8-17
Chapter 8 Configuring Interfaces
"Configuring
and assign
OL-20339-01