Device, then click the link in the
list shows the available interfaces, their names, addresses, and states.
Subinterfaces are grouped under their physical interface.
|| Do one of the
Subinterface from the gear drop-down list to create a new
- Click the edit icon ()
for the subinterface you want to edit.
If you no longer
need a subinterface, click the delete icon ()
for the subinterface to delete it.
||To enable the
parent interface, name, and description:
Interface—Choose the physical interface to which you want to add
the subinterface. You cannot change the parent interface after you create the
- Name—The name for
the subinterface, up to 48 characters. Alphabetic characters must be lower
case. For example,
outside. Without a name, the rest of the interface
configuration is ignored.
If you change the name, the
change is automatically reflected everywhere you used the old name, including
security zones, syslog server objects, and DHCP server definitions. However,
you cannot remove the name until you first remove all configurations that use
the name, because you typically cannot use an unnamed interface for any policy
Description—The description can be up to 200
characters on a single line, without carriage returns.
general subinterface characteristics:
- VLAN ID—Enter the
VLAN ID between 1 and 4094 that will be used to tag the packets on this
ID—Enter the subinterface ID as an integer between 1 and
4294967295. The number of subinterfaces allowed depends on your platform. You
cannot change the ID after you create the subinterface.
Address tab and configure the IPv4 address.
Select one of
the following options from the
(DHCP)—Choose this option if the address should be obtained from the DHCP
server on the network. Change the following options if necessary:
Route Metric—If you obtain the default route from
the DHCP server, the administrative distance to the learned route, between 1
and 255. The default is 1.
Obtain Default Route—Whether to get the default
route from the DHCP server. You would normally select this option, which is the
this option if you want to assign an address that should not change. Type in
the interface's IP address and the subnet mask for the network attached to the
interface. For example, if you attach the 10.100.10.0/24 network, you could
enter 10.100.10.1/24. Ensure that the address is not already used on the
For an existing interface,
your ability to change the address is constrained if you have a DHCP server
configured for the interface. The new IP address must be on the same subnet as
the DHCP address pool, and it cannot be part of that pool. If you need to
configure an address on a different subnet, first delete the DHCP server
Configuring DHCP Server.
Address tab and configure the IPv6 address.
IPv6 processing and to automatically configure the link-local address when you
do not configure the global address, select
Enabled. The link local address is generated based
on the interface MAC addresses (Modified EUI-64 format).
IPv6 does not disable IPv6 processing on an interface that is configured with
an explicit IPv6 address or that is enabled for autoconfiguration.
Configuration—Select this option to have the address automatically
configured. IPv6 stateless autoconfiguration will generate a global IPv6
address only if the link on which the device resides has a router configured to
provide IPv6 services, including the advertisement of an IPv6 global prefix for
use on the link. If IPv6 routing services are not available on the link, you
will get a link-local IPv6 address only, which you cannot access outside of the
device's immediate network link. The link local address is based on the
Modified EUI-64 interface ID.
RFC 4862 specifies that hosts configured for stateless autoconfiguration do not
send Router Advertisement messages, the
Firepower Threat Defense
device does send Router Advertisement messages in this case. Select
Suppress RA to suppress messages and conform to the
Address/Prefix—If you do not use stateless autoconfiguration, enter
the full static global IPv6 address and network prefix. For example,
2001:0DB8::BA98:0:3210/48. For more information on IPv6 addressing, see
If you want
to use the address as link local only, select the
Link - Local option. Link local addresses are not
accessible outside the local network. You cannot configure a link-local address
on a bridge group interface.
link-local address should start with FE8, FE9, FEA, or FEB, for example
fe80::20d:88ff:feee:6a82. Note that we recommend automatically assigning the
link-local address based on the Modified EUI-64 format. For example, if other
devices enforce the use of the Modified EUI-64 format, then a manually-assigned
link-local address may cause packets to be dropped.
RA—Whether to suppress router advertisements. The
Firepower Threat Defense
device can participate in router advertisements so that neighboring devices
can dynamically learn a default router address. By default, router
advertisement messages (ICMPv6 Type 134) are periodically sent out each IPv6
advertisements are also sent in response to router solicitation messages
(ICMPv6 Type 133). Router solicitation messages are sent by hosts at system
startup so that the host can immediately autoconfigure without needing to wait
for the next scheduled router advertisement message.
want to suppress these messages on any interface for which you do not want the
Firepower Threat Defense
device to supply the IPv6 prefix (for example, the outside interface).
Configure Advanced Interface Options.
settings have defaults that are appropriate for most networks. Edit them only
if you are resolving network issues.