Completing Interface Configuration in Routed Mode
This section includes the following topics:
Configuring General Interface Parameters
This procedure describes how to set the name, security level, IPv4 address and other options.
For the ASA 5510 and higher, you must configure interface parameters for the following interface types:
- Physical interfaces
- VLAN subinterfaces
- Redundant interfaces
- EtherChannel interfaces
For the ASA 5505, you must configure interface parameters for the following interface types:
Guidelines and Limitations
- For the ASA 5550, for maximum throughput, be sure to balance your traffic over the two interface slots; for example, assign the inside interface to slot 1 and the outside interface to slot 0.
- If you are using failover, do not use this procedure to name interfaces that you are reserving for failover and Stateful Failover communications. See the “Configuring Active/Standby Failover” section or the “Configuring Active/Active Failover” section to configure the failover and state links.
Restrictions
- PPPoE is not supported in multiple context mode.
Detailed Steps
|
|
|
Step 1 |
For the ASA 5510 and higher: interface {{ redundant number | port-channel number | physical_interface }[. subinterface ] | mapped_name } For the ASA 5505: hostname(config)# interface vlan number
hostname(config)# interface gigabithethernet 0/0 |
If you are not already in interface configuration mode, enters interface configuration mode. The redundant number argument is the redundant interface ID, such as redundant 1. The port-channel number argument is the EtherChannel interface ID, such as port-channel 1. See the “Enabling the Physical Interface and Configuring Ethernet Parameters” section for a description of the physical interface ID. Append the subinterface ID to the physical or redundant interface ID separated by a period (.). In multiple context mode, enter the mapped_name if one was assigned using the allocate-interface command. |
Step 2 |
nameif name
hostname(config-if)# nameif inside |
Names the interface. The name is a text string up to 48 characters, and is not case-sensitive. You can change the name by reentering this command with a new value. Do not enter the no form, because that command causes all commands that refer to that name to be deleted. |
Step 3 |
Do one of the following: |
|
ip address ip_address [ mask ] [ standby ip_address ]
hostname(config-if)# ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2 |
Sets the IP address manually. Note For use with failover, you must set the IP address and standby address manually; DHCP and PPPoE are not supported. The ip_address and mask arguments set the interface IP address and subnet mask. The standby ip_address argument is used for failover. See the “Configuring Active/Standby Failover” section or the “Configuring Active/Active Failover” section for more information. |
|
ip address dhcp [ setroute ]
hostname(config-if)# ip address dhcp |
Obtains an IP address from a DHCP server. The setroute keyword lets the ASA use the default route supplied by the DHCP server. Reenter this command to reset the DHCP lease and request a new lease. If you do not enable the interface using the no shutdown command before you enter the ip address dhcp command, some DHCP requests might not be sent. |
|
To obtain an IP address from a PPPoE server, see Chapter72, “Configuring the PPPoE Client” |
PPPoE is not supported in multiple context mode. |
Step 4 |
security-level number
hostname(config-if)# security-level 50 |
Sets the security level, where number is an integer between 0 (lowest) and 100 (highest). See the “Security Levels” section. |
Step 5 |
(Optional) management-only
hostname(config-if)# management-only |
Sets an interface to management-only mode so that it does not pass through traffic. By default, Management interfaces are configured as management-only. To disable this setting, enter the no management-only command. (ASA 5512-X through ASA 5555-X) You cannot disable management-only on the Management 0/0 interface. The management-only command is not supported for a redundant interface. |
Example
The following example configures parameters for VLAN 101:
hostname(config)# interface vlan 101
hostname(config-if)# nameif inside
hostname(config-if)# security-level 100
hostname(config-if)# ip address 10.1.1.1 255.255.255.0
The following example configures parameters in multiple context mode for the context configuration. The interface ID is a mapped name.
hostname/contextA(config)# interface int1
hostname/contextA(config-if)# nameif outside
hostname/contextA(config-if)# security-level 100
hostname/contextA(config-if)# ip address 10.1.2.1 255.255.255.0
Configuring the MAC Address and MTU
This section describes how to configure MAC addresses for interfaces and how to set the MTU.
Information About MAC Addresses
By default, the physical interface uses the burned-in MAC address, and all subinterfaces of a physical interface use the same burned-in MAC address.
A redundant interface uses the MAC address of the first physical interface that you add. If you change the order of the member interfaces in the configuration, then the MAC address changes to match the MAC address of the interface that is now listed first. If you assign a MAC address to the redundant interface using this command, then it is used regardless of the member interface MAC addresses.
For an EtherChannel, all interfaces that are part of the channel group share the same MAC address. This feature makes the EtherChannel transparent to network applications and users, because they only see the one logical connection; they have no knowledge of the individual links. The port-channel interface uses the lowest numbered channel group interface MAC address as the port-channel MAC address. Alternatively you can manually configure a MAC address for the port-channel interface. In multiple context mode, you can automatically assign unique MAC addresses to interfaces, including an EtherChannel port interface. We recommend manually, or in multiple context mode, automatically configuring a unique MAC address in case the group channel interface membership changes. If you remove the interface that was providing the port-channel MAC address, then the port-channel MAC address changes to the next lowest numbered interface, thus causing traffic disruption.
In multiple context mode, if you share an interface between contexts, you can assign a unique MAC address to the interface in each context. This feature lets the ASA easily classify packets into the appropriate context. Using a shared interface without unique MAC addresses is possible, but has some limitations. See the “How the ASA Classifies Packets” section for more information. You can assign each MAC address manually, or you can automatically generate MAC addresses for shared interfaces in contexts. See the “Automatically Assigning MAC Addresses to Context Interfaces” section to automatically generate MAC addresses. If you automatically generate MAC addresses, you can use this procedure to override the generated address.
For single context mode, or for interfaces that are not shared in multiple context mode, you might want to assign unique MAC addresses to subinterfaces. For example, your service provider might perform access control based on the MAC address.
Information About the MTU
The MTU is the maximum datagram size that is sent on a connection. Data that is larger than the MTU value is fragmented before being sent.
The ASA supports IP path MTU discovery (as defined in RFC 1191), which allows a host to dynamically discover and cope with the differences in the maximum allowable MTU size of the various links along the path. Sometimes, the ASA cannot forward a datagram because the packet is larger than the MTU that you set for the interface, but the “don't fragment” (DF) bit is set. The network software sends a message to the sending host, alerting it to the problem. The host has to fragment packets for the destination so that they fit the smallest packet size of all the links along the path.
The default MTU is 1500 bytes in a block for Ethernet interfaces. This value is sufficient for most applications, but you can pick a lower number if network conditions require it.
To enable jumbo frames, see the “Enabling Jumbo Frame Support (Supported Models)” section. A jumbo frame is an Ethernet packet larger than the standard maximum of 1518 bytes (including Layer 2 header and FCS), up to 9216 bytes. Jumbo frames require extra memory to process, and assigning more memory for jumbo frames might limit the maximum use of other features, such as access lists. To use jumbo frames, set the value higher, for example, to 9000 bytes.
Detailed Steps
|
|
|
Step 1 |
For the ASA 5510 and higher: interface {{ redundant number | port-channel number | physical_interface }[. subinterface ] | mapped_name } For the ASA 5505: hostname(config)# interface vlan number
hostname(config)# interface vlan 100 |
If you are not already in interface configuration mode, enters interface configuration mode. The redundant number argument is the redundant interface ID, such as redundant 1. The port-channel number argument is the EtherChannel interface ID, such as port-channel 1. See the “Enabling the Physical Interface and Configuring Ethernet Parameters” section for a description of the physical interface ID. Append the subinterface ID to the physical or redundant interface ID separated by a period (.). In multiple context mode, enter the mapped_name if one was assigned using the allocate-interface command. |
Step 2 |
mac-address m ac_address [ standby mac_address ]
hostname(config-if)# mac-address 000C.F142.4CDE |
Assigns a private MAC address to this interface. The mac_address is in H.H.H format, where H is a 16-bit hexadecimal digit. For example, the MAC address 00-0C-F1-42-4C-DE is entered as 000C.F142.4CDE. The first two bytes of a manual MAC address cannot be A2 if you also want to use auto-generated MAC addresses. For use with failover, set the standby MAC address. If the active unit fails over and the standby unit becomes active, the new active unit starts using the active MAC addresses to minimize network disruption, while the old active unit uses the standby address. |
Step 3 |
mtu interface_name bytes
hostname(config)# mtu inside 9200 |
Sets the MTU between 300 and 65,535 bytes. The default is 1500 bytes. Note When you set the MTU for a redundant or port-channel interface, the ASA applies the setting to all member interfaces. For models that support jumbo frames, if you enter a value for any interface that is greater than 1500, then you need to enable jumbo frame support. See the “Enabling Jumbo Frame Support (Supported Models)” section. |
Information About IPv6
This section includes information about how to configure IPv6, and includes the following topics:
IPv6 Addressing
You can configure two types of unicast addresses for IPv6:
- Global—The global address is a public address that you can use on the public network.
- Link-local—The link-local address is a private address that you can only use on the directly-connected network. Routers do not forward packets using link-local addresses; they are only for communication on a particular physical network segment. They can be used for address configuration or for the ND functions such as address resolution and neighbor discovery.
At a minimum, you need to configure a link-local addresses for IPv6 to operate. If you configure a global address, a link-local address is automatically configured on the interface, so you do not also need to specifically configure a link-local address. If you do not configure a global address, then you need to configure the link-local address, either automatically or manually.
Note If you want to only configure the link-local addresses, see the ipv6 enable (to auto-configure) or ipv6 address link-local (to manually configure) command in the command reference.
Duplicate Address Detection
During the stateless autoconfiguration process, duplicate address detection (DAD) verifies the uniqueness of new unicast IPv6 addresses before the addresses are assigned to interfaces (the new addresses remain in a tentative state while duplicate address detection is performed). Duplicate address detection is performed first on the new link-local address. When the link-local address is verified as unique, then duplicate address detection is performed all the other IPv6 unicast addresses on the interface.
Duplicate address detection is suspended on interfaces that are administratively down. While an interface is administratively down, the unicast IPv6 addresses assigned to the interface are set to a pending state. An interface returning to an administratively up state restarts duplicate address detection for all of the unicast IPv6 addresses on the interface.
When a duplicate address is identified, the state of the address is set to DUPLICATE, the address is not used, and the following error message is generated:
%ASA-4-325002: Duplicate address ipv6_address/MAC_address on interface
If the duplicate address is the link-local address of the interface, the processing of IPv6 packets is disabled on the interface. If the duplicate address is a global address, the address is not used. However, all configuration commands associated with the duplicate address remain as configured while the state of the address is set to DUPLICATE.
If the link-local address for an interface changes, duplicate address detection is performed on the new link-local address and all of the other IPv6 address associated with the interface are regenerated (duplicate address detection is performed only on the new link-local address).
The ASA uses neighbor solicitation messages to perform duplicate address detection. By default, the number of times an interface performs duplicate address detection is 1.
Modified EUI-64 Interface IDs
RFC 3513: Internet Protocol Version 6 (IPv6) Addressing Architecture requires that the interface identifier portion of all unicast IPv6 addresses, except those that start with binary value 000, be 64 bits long and be constructed in Modified EUI-64 format. The ASA can enforce this requirement for hosts attached to the local link.
When this feature is enabled on an interface, the source addresses of IPv6 packets received on that interface are verified against the source MAC addresses to ensure that the interface identifiers use the Modified EUI-64 format. If the IPv6 packets do not use the Modified EUI-64 format for the interface identifier, the packets are dropped and the following system log message is generated:
%ASA-3-325003: EUI-64 source address check failed.
The address format verification is only performed when a flow is created. Packets from an existing flow are not checked. Additionally, the address verification can only be performed for hosts on the local link. Packets received from hosts behind a router will fail the address format verification, and be dropped, because their source MAC address will be the router MAC address and not the host MAC address.
Configuring a Global IPv6 Address and Other Options
To configure a global IPv6 address and other options, perform the following steps.
Note Configuring the global address automatically configures the link-local address, so you do not need to configure it separately.
Restrictions
The ASA does not support IPv6 anycast addresses.
Detailed Steps
|
|
|
Step 1 |
For the ASA 5510 and higher: interface {{ redundant number | port-channel number | physical_interface }[. subinterface ] | mapped_name } For the ASA 5505: hostname(config)# interface vlan number
hostname(config)# interface gigabithethernet 0/0 |
If you are not already in interface configuration mode, enters interface configuration mode. The redundant number argument is the redundant interface ID, such as redundant 1. The port-channel number argument is the EtherChannel interface ID, such as port-channel 1. See the “Enabling the Physical Interface and Configuring Ethernet Parameters” section for a description of the physical interface ID. Append the subinterface ID to the physical or redundant interface ID separated by a period (.). In multiple context mode, enter the mapped_name if one was assigned using the allocate-interface command. |
Step 2 |
Do one of the following: |
|
ipv6 address autoconfig
hostname(config-if)# ipv6 address autoconfig |
Enables stateless autoconfiguration on the interface. Enabling stateless autoconfiguration on the interface configures IPv6 addresses based on prefixes received in Router Advertisement messages. A link-local address, based on the Modified EUI-64 interface ID, is automatically generated for the interface when stateless autoconfiguration is enabled. Note Although RFC 4862 specifies that hosts configured for stateless autoconfiguration do not send Router Advertisement messages, the ASA does send Router Advertisement messages in this case. See the ipv6 nd suppress-ra command to suppress messages. |
|
ipv6 address ipv6-address/prefix-length [ standby ipv6-address ]
hostname(config-if)# ipv6 address 2001:0DB8::BA98:0:3210/48 |
Assigns a global address to the interface. When you assign a global address, the link-local address is automatically created for the interface. standby specifies the interface address used by the secondary unit or failover group in a failover pair. See the “IPv6 Addresses” section for more information about IPv6 addressing. |
|
ipv6 address ipv6-prefix/prefix-length eui-64
hostname(config-if)# ipv6 address 2001:0DB8::BA98::/48 eui-64 |
Assigns a global address to the interface by combining the specified prefix with an interface ID generated from the interface MAC address using the Modified EUI-64 format. When you assign a global address, the link-local address is automatically created for the interface. Y ou do not need to specify the standby address; the interface ID will be generated automatically. See the “IPv6 Addresses” section for more information about IPv6 addressing. |
Step 3 |
(Optional) ipv6 nd suppress-ra
hostname(config-if)# ipv6 nd suppress-ra |
Suppresses Router Advertisement messages on an interface. By default, Router Advertisement messages are automatically sent in response to router solicitation messages. You may want to disable these messages on any interface for which you do not want the ASA to supply the IPv6 prefix (for example, the outside interface). |
Step 4 |
(Optional) ipv6 nd dad attempts value
hostname(config-if)# ipv6 nd dad attempts 3 |
Changes the number of duplicate address detection attempts. The value argument can be any value from 0 to 600. Setting the value argument to 0 disables duplicate address detection on the interface. By default, the number of times an interface performs duplicate address detection is 1. See the “Duplicate Address Detection” section for more information. |
Step 5 |
(Optional) ipv6 nd ns-interval value
hostname(config-if)# ipv6 nd ns-interval 2000 |
Changes the neighbor solicitation message interval. When you configure an interface to send out more than one duplicate address detection attempt with the ipv6 nd dad attempts command, this command configures the interval at which the neighbor solicitation messages are sent out. By default, they are sent out once every 1000 milliseconds. The value argument can be from 1000 to 3600000 milliseconds. Note Changing this value changes it for all neighbor solicitation messages sent out on the interface, not just those used for duplicate address detection. |
Step 6 |
(Optional)
ipv6 enforce-eui64
if_name
hostname(config)# ipv6 enforce-eui64 inside
|
Enforces the use of Modified EUI-64 format interface identifiers in IPv6 addresses on a local link. The if_name argument is the name of the interface, as specified by the nameif command, on which you are enabling the address format enforcement. See the “Modified EUI-64 Interface IDs” section for more information. |
Allowing Same Security Level Communication
By default, interfaces on the same security level cannot communicate with each other, and packets cannot enter and exit the same interface. This section describes how to enable inter-interface communication when interfaces are on the same security level, and how to enable intra-interface communication.
Information About Inter-Interface Communication
Allowing interfaces on the same security level to communicate with each other provides the following benefits:
- You can configure more than 101 communicating interfaces.
If you use different levels for each interface and do not assign any interfaces to the same security level, you can configure only one interface per level (0 to 100).
- You want traffic to flow freely between all same security interfaces without access lists.
If you enable same security interface communication, you can still configure interfaces at different security levels as usual.
Information About Intra-Interface Communication
Intra-interface communication might be useful for VPN traffic that enters an interface, but is then routed out the same interface. The VPN traffic might be unencrypted in this case, or it might be reencrypted for another VPN connection. For example, if you have a hub and spoke VPN network, where the ASA is the hub, and remote VPN networks are spokes, for one spoke to communicate with another spoke, traffic must go into the ASA and then out again to the other spoke.
Note All traffic allowed by this feature is still subject to firewall rules. Be careful not to create an asymmetric routing situation that can cause return traffic not to traverse the ASA.
Detailed Steps
|
|
same-security-traffic permit inter-interface |
Enables interfaces on the same security level so that they can communicate with each other. |
same-security-traffic permit intra-interface |
Enables communication between hosts connected to the same interface. |