Cisco ASA Series Cli Configuration Manual page 436

Starting Interface Configuration (ASA 5510 and Higher)
Guidelines and Limitations
•
•
•
Prerequisites
For multiple context mode, complete this procedure in the system execution space. To change from the
context to the system execution space, enter the changeto system command.
Detailed Steps
Command
Step 1
interface {physical_interface | redundant
number | port-channel number}.subinterface
Example:
hostname(config)# interface
gigabitethernet 0/1.100
Step 2
vlan vlan_id
Example:
hostname(config-subif)# vlan 101
Cisco ASA Series CLI Configuration Guide
1-32
Maximum subinterfaces—To determine how many VLAN subinterfaces are allowed for your
platform, see the "Licensing Requirements for ASA 5510 and Higher Interfaces" section on
page 1-8.
Preventing untagged packets on the physical interface—If you use subinterfaces, you typically do
not also want the physical interface to pass traffic, because the physical interface passes untagged
packets. This property is also true for the active physical interface in a redundant interface pair.
Because the physical or redundant interface must be enabled for the subinterface to pass traffic,
ensure that the physical or redundant interface does not pass traffic by leaving out the nameif
command. If you want to let the physical or redundant interface pass untagged packets, you can
configure the nameif command as usual. See
(Routed Mode)," or Chapter 1, "Completing Interface Configuration (Transparent Mode),"
information about completing the interface configuration.
(ASA 5512-X through ASA 5555-X) You cannot configure subinterfaces on the Management 0/0
interface.
Chapter 1 Starting Interface Configuration (ASA 5510 and Higher)
Chapter 1, "Completing Interface Configuration
Purpose
Specifies the new subinterface. See the
Interface and Configuring Ethernet Parameters"
description of the physical interface ID.
The redundant number argument is the redundant interface ID,
such as redundant 1.
The port-channel number argument is the EtherChannel interface
ID, such as port-channel 1.
The subinterface ID is an integer between 1 and 4294967293.
Specifies the VLAN for the subinterface. The vlan_id is an integer
between 1 and 4094. Some VLAN IDs might be reserved on
connected switches, so check the switch documentation for more
information.
You can only assign a single VLAN to a subinterface, and you
cannot assign the same VLAN to multiple subinterfaces. You
cannot assign a VLAN to the physical interface. Each subinterface
must have a VLAN ID before it can pass traffic. To change a
VLAN ID, you do not need to remove the old VLAN ID with the
no option; you can enter the vlan command with a different
VLAN ID, and the ASA changes the old ID.
for more
"Enabling the Physical
section for a