Interface Start
Interface Start
This chapter includes tasks for starting your interface configuration for the ASA 5510 and higher,
including configuring Ethernet settings, redundant interfaces, and EtherChannels.
Note For ASA 5505 configuration, see Chapter 13, “Starting Interface Configuration (ASA 5505).”
For multiple context mode, complete all tasks in this section in the system execution space. To change
from the context to the system execution space, enter the changeto system command.
Auto-MDI/MDIX Feature
For RJ-45 interfaces on the ASA 5500 series, the default auto-negotiation setting also includes the
Auto-MDI/MDIX feature. Auto-MDI/MDIX eliminates the need for crossover cabling by performing an
internal crossover when a straight cable is detected during the auto-negotiation phase. Either the speed
or duplex must be set to auto-negotiate to enable Auto-MDI/MDIX for the interface. If you explicitly set
both the speed and duplex to a fixed value, thus disabling auto-negotiation for both settings, then
Auto-MDI/MDIX is also disabled. For Gigabit Ethernet, when the speed and duplex are set to 1000 and
full, then the interface always auto-negotiates; therefore Auto-MDI/MDIX is always enabled and you
cannot disable it.
Management Interface
• Management Interface Overview, page 12-2
• Management Slot/Port Interface, page 12-2
• Using Any Interface for Management-Only Traffic, page 12-3
• Management Interface for Transparent Mode, page 12-3
• No Support for Redundant Management Interfaces, page 12-4
• Management 0/0 Interface on the ASA 5512-X through ASA 5555-X, page 12-4
Configurable for
Model Through Traffic1 Management 0/02 Management 0/1 Management 1/0 Management 1/1
ASA 5505 N/A No No No No
ASA 5510 Yes Yes No No No
Configurable for
Model Through Traffic1 Management 0/02 Management 0/1 Management 1/0 Management 1/1
ASA 5520 Yes Yes No No No
ASA 5540 Yes Yes No No No
ASA 5550 Yes Yes No No No
ASA 5580 Yes Yes Yes No No
ASA 5512-X No Yes No No No
ASA 5515-X No Yes No No No
ASA 5525-X No Yes No No No
ASA 5545-X No Yes No No No
ASA 5555-X No Yes No No No
3
ASA 5585-X Yes Yes Yes Yes Yes3
1. By default, the Management 0/0 interface is configured for management-only traffic (the management-only command). For supported models in routed
mode, you can remove the limitation and pass through traffic. If your model includes additional Management interfaces, you can use them for through
traffic as well. The Management interfaces might not be optimized for through-traffic, however.
2. The Management 0/0 interface is configured for ASDM access as part of the default factory configuration. See the “Factory Default Configurations”
section on page 3-10 for more information.
3. If you installed an SSP in slot 1, then Management 1/0 and 1/1 provide management access to the SSP in slot 1 only.
Note If you installed an IPS module, then the IPS module management interface(s) provides management
access for the IPS module only. For the ASA 5512-X through ASA 5555-X, the IPS SSP software
module uses the same physical Management 0/0 interface as the ASA.
For 8.4(1) and later, the management interface is not part of a normal bridge group. Note that for
operational purposes, it is part of a non-configurable bridge group.
Note In transparent firewall mode, the management interface updates the MAC address table in the same
manner as a data interface; therefore you should not connect both a management and a data interface to
the same switch unless you configure one of the switch ports as a routed port (by default Cisco Catalyst
switches share a MAC address for all VLAN switch ports). Otherwise, if traffic arrives on the
management interface from the physically-connected switch, then the ASA updates the MAC address
table to use the management interface to access the switch, instead of the data interface. This action
causes a temporary traffic interruption; the ASA will not re-update the MAC address table for packets
from the switch to the data interface for at least 30 seconds for security reasons.
Redundant Interfaces
A logical redundant interface consists of a pair of physical interfaces: an active and a standby interface.
When the active interface fails, the standby interface becomes active and starts passing traffic. You can
configure a redundant interface to increase the ASA reliability. This feature is separate from device-level
failover, but you can configure redundant interfaces as well as device-level failover if desired.
EtherChannels
An 802.3ad EtherChannel is a logical interface (called a port-channel interface) consisting of a bundle
of individual Ethernet links (a channel group) so that you increase the bandwidth for a single network.
A port channel interface is used in the same way as a physical interface when you configure
interface-related features.
You can configure up to 48 EtherChannels.
This section includes the following topics:
• Channel Group Interfaces, page 12-5
• Connecting to an EtherChannel on Another Device, page 12-5
• Link Aggregation Control Protocol, page 12-6
• Load Balancing, page 12-7
• EtherChannel MAC Address, page 12-7
VSS
Switch 1 Switch 2
ASA
If you use the ASA in an Active/Standby failover deployment, then you need to create separate
EtherChannels on the switches in the VSS, one for each ASA (see Figure 12-1). On each ASA, a single
EtherChannel connects to both switches. Even if you could group all switch interfaces into a single
EtherChannel connecting to both ASAs (in this case, the EtherChannel will not be established because
of the separate ASA system IDs), a single EtherChannel would not be desirable because you do not want
traffic sent to the standby ASA.
VSS
Switch 1 Switch 2
• On—The EtherChannel is always on, and LACP is not used. An “on” EtherChannel can only
establish a connection with another “on” EtherChannel.
LACP coordinates the automatic addition and deletion of links to the EtherChannel without user
intervention. It also handles misconfigurations and checks that both ends of member interfaces are
connected to the correct channel group. “On” mode cannot use standby interfaces in the channel group
when an interface goes down, and the connectivity and configurations are not checked.
Load Balancing
The ASA distributes packets to the interfaces in the EtherChannel by hashing the source and destination
IP address of the packet (this criteria is configurable; see the “Customizing the EtherChannel” section
on page 12-30). The hash result is a 3-bit value (0 to 7).
The eight hash result values are distributed in a round robin fashion between the channel group
interfaces, starting with the interface with the lowest ID (slot/port). For example, all packets with a hash
result of 0 go to GigabitEthernet 0/0, packets with a hash result of 1 go to GigabitEthernet 0/1, packets
with a hash result of 2 go to GigabitEthernet 0/2, and so on.
Because there are eight hash result values regardless of how many active interfaces are in the
EtherChannel, packets might not be distributed evenly depending on the number of active interfaces.
Table 12-2 shows the load balancing amounts per interface for each number of active interfaces. The
active interfaces in bold have even distribution.
If an active interface goes down and is not replaced by a standby interface, then traffic is rebalanced
between the remaining links. The failure is masked from both Spanning Tree at Layer 2 and the routing
table at Layer 3, so the switchover is transparent to other network devices.
Failover Guidelines
• When you use a redundant or EtherChannel interface as a failover link, it must be pre-configured on
both units in the failover pair; you cannot configure it on the primary unit and expect it to replicate
to the secondary unit because the failover link itself is required for replication.
• If you use a redundant or EtherChannel interface for the state link, no special configuration is
required; the configuration can replicate from the primary unit as normal.
• You can monitor redundant or EtherChannel interfaces for failover using the monitor-interface
command; be sure to reference the logical redundant interface name. When an active member
interface fails over to a standby interface, this activity does not cause the redundant or EtherChannel
interface to appear to be failed when being monitored for device-level failover. Only when all
physical interfaces fail does the redundant or EtherChannel interface appear to be failed (for an
EtherChannel interface, the number of member interfaces allowed to fail is configurable).
• If you use an EtherChannel interface for a failover or state link, then to prevent out-of-order packets,
only one interface in the EtherChannel is used. If that interface fails, then the next interface in the
EtherChannel is used. You cannot alter the EtherChannel configuration while it is in use as a failover
link. To alter the configuration, you need to either shut down the EtherChannel while you make
changes, or temporarily disable failover; either action prevents failover from occurring for the
duration.
• Although you can configure failover and failover state links on a port channel link, this port channel
cannot be shared with other firewall traffic.
• If you shut down the active interface, then the standby interface becomes active.
• Redundant interfaces do not support Management slot/port interfaces as members. You also cannot
set a redundant interface comprised of non-Management interfaces as management-only.
• For failover guidelines, see the “Failover Guidelines” section on page 12-10.
EtherChannel Guidelines
• You can configure up to 48 EtherChannels.
• Each channel group can have eight active interfaces. Note that you can assign up to 16 interfaces to
a channel group. While only eight interfaces can be active, the remaining interfaces can act as
standby links in case of interface failure.
• All interfaces in the channel group must be the same type and speed. The first interface added to the
channel group determines the correct type and speed.
• The device to which you connect the ASA EtherChannel must also support 802.3ad EtherChannels;
for example, you can connect to the Catalyst 6500 switch.
• The ASA does not support LACPDUs that are VLAN-tagged. If you enable native VLAN tagging
on the neighboring switch using the Cisco IOS vlan dot1Q tag native command, then the ASA will
drop the tagged LACPDUs. Be sure to disable native VLAN tagging on the neighboring switch. In
multiple context mode, these messages are not included in a packet capture, so you cannot diagnose
the issue effectively.
• The ASA does not support connecting an EtherChannel to a switch stack. If the ASA EtherChannel
is connected cross stack, and if the Master switch is powered down, then the EtherChannel
connected to the remaining switch will not come up.
• All ASA configuration refers to the logical EtherChannel interface instead of the member physical
interfaces.
• You cannot use a redundant interface as part of an EtherChannel, nor can you use an EtherChannel
as part of a redundant interface. You cannot use the same physical interfaces in a redundant interface
and an EtherChannel interface. You can, however, configure both types on the ASA if they do not
use the same physical interfaces.
• You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the ASA
5550, as part of an EtherChannel.
• For failover guidelines, see the “Failover Guidelines” section on page 12-10.
Default Settings
This section lists default settings for interfaces if you do not have a factory default configuration. For
information about the factory default configurations, see the “Factory Default Configurations” section
on page 3-10.
• Physical interfaces—Disabled.
• Redundant Interfaces—Enabled. However, for traffic to pass through the redundant interface, the
member physical interfaces must also be enabled.
• Subinterfaces—Enabled. However, for traffic to pass through the subinterface, the physical interface
must also be enabled.
• EtherChannel port-channel interfaces—Enabled. However, for traffic to pass through the
EtherChannel, the channel group physical interfaces must also be enabled.
Note If you have an existing configuration, and want to convert interfaces that are in use to a redundant or
EtherChannel interface, perform your configuration offline to minimize disruption. See the “Converting
In-Use Interfaces to a Redundant or EtherChannel Interface” section on page 12-13.
Step 1 (Multiple context mode) Complete all tasks in this section in the system execution space. To change from
the context to the system execution space, enter the changeto system command.
Step 2 Enable the physical interface, and optionally change Ethernet parameters. See the “Enabling the Physical
Interface and Configuring Ethernet Parameters” section on page 12-23.
Physical interfaces are disabled by default.
Step 3 (Optional) Configure redundant interface pairs. See the “Configuring a Redundant Interface” section on
page 12-26.
A logical redundant interface pairs an active and a standby physical interface. When the active interface
fails, the standby interface becomes active and starts passing traffic.
Step 4 (Optional) Configure an EtherChannel. See the “Configuring an EtherChannel” section on page 12-28.
An EtherChannel groups multiple Ethernet interfaces into a single logical interface.
Note You cannot use interfaces on the 4GE SSM, including the integrated 4GE SSM in slot 1 on the
ASA 5550, as part of an EtherChannel.
Step 5 (Optional) Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q
Trunking” section on page 12-31.
Step 6 (Optional) Enable jumbo frame support on the ASA 5580 and 5585-X according to the “Enabling Jumbo
Frame Support (Supported Models)” section on page 12-33.
Step 7 (Multiple context mode only) To complete the configuration of interfaces in the system execution space,
perform the following tasks that are documented in Chapter 6, “Configuring Multiple Context Mode”:
• To assign interfaces to contexts, see the “Configuring a Security Context” section on page 6-18.
• (Optional) To automatically assign unique MAC addresses to context interfaces, see the
“Automatically Assigning MAC Addresses to Context Interfaces” section on page 6-22.
The MAC address is used to classify packets within a context. If you share an interface, but do not have
unique MAC addresses for the interface in each context, then the destination IP address is used to
classify packets. Alternatively, you can manually assign MAC addresses within the context according to
the “Configuring the MAC Address and MTU” section on page 8-9.
Step 8 Complete the interface configuration according to Chapter 8, “Completing Interface Configuration
(Routed Mode),” or Chapter 9, “Completing Interface Configuration (Transparent Mode).”
We recommend that you update your configuration offline as a text file, and reimport the whole
configuration for the following reasons:
• Because you cannot add a named interface as a member of a redundant or EtherChannel interface,
you must remove the name from the interface. When you remove the name from the interface, any
command that referred to that name is deleted. Because commands that refer to interface names are
widespread throughout the configuration and affect multiple features, removing a name from an
in-use interface at the CLI or in ASDM would cause significant damage to your configuration, not
to mention significant downtime while you reconfigure all your features around a new interface
name.
• Changing your configuration offline lets you use the same interface names for your new logical
interfaces, so you do not need to touch the feature configurations that refer to interface names. You
only need to change the interface configuration.
• Clearing the running configuration and immediately applying a new configuration will minimize the
downtime of your interfaces. You will not be waiting to configure the interfaces in real time.
Step 1 Connect to the ASA; if you are using failover, connect to the active ASA.
Step 2 If you are using failover, disable failover by entering the no failover command.
Step 3 Copy the running configuration by entering the more system:running-config command and copying the
display output to a text editor.
Be sure to save an extra copy of the old configuration in case you make an error when you edit it.
Step 4 For each in-use interface that you want to add to a redundant or EtherChannel interface, cut and paste
all commands under the interface command to the end of the interface configuration section for use in
creating your new logical interfaces. The only exceptions are the following commands, which should
stay with the physical interface configuration:
• media-type
• speed
• duplex
• flowcontrol
Note You can only add physical interfaces to an EtherChannel or redundant interface; you cannot have
VLANs configured for the physical interfaces.
Be sure to match the above values for all interfaces in a given EtherChannel or redundant
interface. Note that the duplex setting for an EtherChannel interface must be Full or Auto.
For example, you have the following interface configuration. The bolded commands are the ones we
want to use with three new EtherChannel interfaces, and that you should cut and paste to the end of the
interface section.
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.86.194.225 255.255.255.0
no shutdown
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.1.3 255.255.255.0
no shutdown
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif mgmt
security-level 100
ip address 10.1.1.5 255.255.255.0
no shutdown
!
interface Management0/1
shutdown
no nameif
no security-level
no ip address
Step 5 Above each pasted command section, create your new logical interfaces by entering one of the following
commands:
• interface redundant number [1-8]
• interface port-channel channel_id [1-48]
For example:
...
interface port-channel 1
nameif outside
security-level 0
ip address 10.86.194.225 255.255.255.0
no shutdown
!
interface port-channel 2
nameif inside
security-level 100
ip address 192.168.1.3 255.255.255.0
no shutdown
!
interface port-channel 3
nameif mgmt
security-level 100
ip address 10.1.1.5 255.255.255.0
no shutdown
Where the physical interfaces are any two interfaces of the same type (either formerly in use or
unused). You cannot assign a Management interface to a redundant interface.
For example, to take advantage of existing cabling, you would continue to use the formerly in-use
interfaces in their old roles as part of the inside and outside redundant interfaces:
interface redundant 1
nameif outside
security-level 0
ip address 10.86.194.225 255.255.255.0
member-interface GigabitEthernet0/0
member-interface GigabitEthernet0/2
interface redundant 2
nameif inside
security-level 100
ip address 192.168.1.3 255.255.255.0
member-interface GigabitEthernet0/1
member-interface GigabitEthernet0/3
• EtherChannel interface—Enter the following command under each interface you want to add to the
EtherChannel (either formerly in use or unused). You can assign up to 16 interfaces per
EtherChannel, although only eight can be active; the others are in a standby state in case of failure.
channel-group channel_id mode active
For example, to take advantage of existing cabling, you would continue to use the formerly in-use
interfaces in their old roles as part of the inside and outside EtherChannel interfaces:
interface GigabitEthernet0/0
channel-group 1 mode active
no shutdown
!
interface GigabitEthernet0/1
channel-group 2 mode active
no shutdown
!
interface GigabitEthernet0/2
channel-group 1 mode active
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
channel-group 1 mode active
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
channel-group 2 mode active
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
channel-group 2 mode active
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
channel-group 3 mode active
no shutdown
!
interface Management0/1
channel-group 3 mode active
shutdown
no nameif
no security-level
no ip address
...
Step 7 Enable each formerly unused interface that is now part of a logical interface by adding no in front of the
shutdown command.
For example, your final EtherChannel configuration is:
interface GigabitEthernet0/0
channel-group 1 mode active
no shutdown
!
interface GigabitEthernet0/1
channel-group 2 mode active
no shutdown
!
interface GigabitEthernet0/2
channel-group 1 mode active
no shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
channel-group 1 mode active
no shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
channel-group 2 mode active
no shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
Note Other optional EtherChannel parameters can be configured after you import the new
configuration. See the “Configuring an EtherChannel” section on page 12-28.
Step 8 At the ASA CLI prompt, perform the following steps depending on your connection (console or remote).
• Console connection:
a. Copy the entire new configuration to the clipboard, including the altered interface section.
b. Clear the running configuration by entering:
hostname(config)# clear configure all
We recommend that you update your system and context configurations offline as text files, and reimport
them for the following reasons:
• Because you cannot add an allocated interface as a member of a redundant or EtherChannel
interface, you must deallocate the interface from any contexts. When you deallocate the interface,
any context command that referred to that interface is deleted. Because commands that refer to
interfaces are widespread throughout the configuration and affect multiple features, removing an
allocation from an in-use interface at the CLI or in ASDM would cause significant damage to your
configuration, not to mention significant downtime while you reconfigure all your features around
a new interface.
• Changing your configuration offline lets you use the same interface names for your new logical
interfaces, so you do not need to touch the feature configurations that refer to interface names. You
only need to change the interface configuration.
• Clearing the running system configuration and immediately applying a new configuration will
minimize the downtime of your interfaces. You will not be waiting to configure the interfaces in real
time.
Step 1 Connect to the ASA, and change to the system; if you are using failover, connect to the active ASA.
Step 2 If you are using failover, disable failover by entering the no failover command.
Step 3 In the system, copy the running configuration by entering the more system:running-config command
and copying the display output to a text editor.
Be sure to save an extra copy of the old configuration in case you make an error when you edit it.
For example, you have the following interface configuration and allocation in the system configuration,
with shared interfaces between two contexts.
System
interface GigabitEthernet0/0
no shutdown
interface GigabitEthernet0/1
no shutdown
interface GigabitEthernet0/2
shutdown
interface GigabitEthernet0/3
shutdown
interface GigabitEthernet0/4
shutdown
interface GigabitEthernet0/5
shutdown
interface Management0/0
no shutdown
interface Management1/0
shutdown
!
context customerA
allocate-interface gigabitethernet0/0 int1
Step 4 Get copies of all context configurations that will use the new EtherChannel or redundant interface. See
the “Backing Up a Context Configuration or Other File in Flash Memory” section on page 81-8.
For example, you download the following context configurations (interface configuration shown):
CustomerA Context
interface int1
nameif outside
security-level 0
ip address 10.86.194.225 255.255.255.0
!
interface int2
nameif inside
security-level 100
ip address 192.168.1.3 255.255.255.0
no shutdown
!
interface mgmt
nameif mgmt
security-level 100
ip address 10.1.1.5 255.255.255.0
management-only
CustomerB Context
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.20.15.5 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.6.78 255.255.255.0
!
interface Management0/0
nameif mgmt
security-level 100
ip address 10.8.1.8 255.255.255.0
management-only
Step 5 In the system configuration, create the new logical interfaces according to the “Configuring a Redundant
Interface” section on page 12-26 or the “Configuring an EtherChannel” section on page 12-28. Be sure
to enter the no shutdown command on any additional physical interfaces you want to use as part of the
logical interface.
Note You can only add physical interfaces to an EtherChannel or redundant interface; you cannot have
VLANs configured for the physical interfaces.
Be sure to match physical interface parameters such as speed and duplex for all interfaces in a
given EtherChannel or redundant interface. Note that the duplex setting for an EtherChannel
interface must be Full or Auto.
System
interface GigabitEthernet0/0
channel-group 1 mode active
no shutdown
!
interface GigabitEthernet0/1
channel-group 2 mode active
no shutdown
!
interface GigabitEthernet0/2
channel-group 1 mode active
no shutdown
!
interface GigabitEthernet0/3
channel-group 1 mode active
no shutdown
!
interface GigabitEthernet0/4
channel-group 2 mode active
no shutdown
!
interface GigabitEthernet0/5
channel-group 2 mode active
no shutdown
!
interface Management0/0
channel-group 3 mode active
no shutdown
!
interface Management0/1
channel-group 3 mode active
no shutdown
!
interface port-channel 1
interface port-channel 2
interface port-channel 3
Step 6 Change the interface allocation per context to use the new EtherChannel or redundant interfaces. See the
“Configuring a Security Context” section on page 6-18.
For example, to take advantage of existing cabling, you would continue to use the formerly in-use
interfaces in their old roles as part of the inside and outside redundant interfaces:
context customerA
allocate-interface port-channel1 int1
allocate-interface port-channel2 int2
allocate-interface port-channel3 mgmt
context customerB
allocate-interface port-channel1
allocate-interface port-channel2
allocate-interface port-channel3
Note You might want to take this opportunity to assign mapped names to interfaces if you have not
done so already. For example, the configuration for customerA does not need to be altered at all;
it just needs to be reapplied on the ASA. The customerB configuration, however, needs to have
all of the interface IDs changed; if you assign mapped names for customerB, you still have to
change the interface IDs in the context configuration, but mapped names might help future
interface changes.
Step 7 For contexts that do not use mapped names, change the context configuration to use the new
EtherChannel or redundant interface ID. (Contexts that use mapped interface names do not require any
alteration.)
For example:
CustomerB Context
interface port-channel1
nameif outside
security-level 0
ip address 10.20.15.5 255.255.255.0
!
interface port-channel2
nameif inside
security-level 100
ip address 192.168.6.78 255.255.255.0
!
interface port-channel3
nameif mgmt
security-level 100
ip address 10.8.1.8 255.255.255.0
management-only
Step 8 Copy the new context configuration files over the old ones. For example, if your contexts are on an FTP
server, copy over the existing files (making backups as desired) using FTP. If your contexts are in flash
memory, you can use the copy command and run a TFTP or FTP server on your PC, or use secure copy.
See the “Downloading a File to a Specific Location” section on page 81-3. This change only affects the
startup configuration; the running configuration is still using the old context configuration.
Step 9 At the ASA system CLI prompt, perform the following steps depending on your connection (console or
remote).
• Console connection:
a. Copy the entire new system configuration to the clipboard, including the altered interface
section.
b. Clear the running configuration (both system and contexts) by entering:
hostname(config)# clear configure all
a. Save the new system configuration to a TFTP or FTP server, so you can copy it to the startup
configuration on the ASA. For example, you can run a TFTP or FTP server on your PC.
b. Clear the startup configuration by entering:
hostname(config)# write erase
Prerequisites
For multiple context mode, complete this procedure in the system execution space. To change from the
context to the system execution space, enter the changeto system command.
Detailed Steps
Command Purpose
Step 1 interface physical_interface Specifies the interface you want to configure.
where the physical_interface ID includes the type, slot, and port
Example: number as type[slot/]port.
hostname(config)# interface
gigabitethernet 0/0
The physical interface types include the following:
• ethernet
• gigabitethernet
• tengigabitethernet
• management
Enter the type followed by slot/port, for example,
gigabitethernet0/1 or ethernet 0/1. A space is optional between
the type and the slot/port.
Step 2 (Optional) Sets the media type to SFP, if available for your model. To restore
media-type sfp the default RJ-45, enter the media-type rj45 command.
Example:
hostname(config-if)# media-type sfp
Step 3 (Optional) Sets the speed.
speed {auto | 10 | 100 | 1000 | For copper interfaces, the default setting is auto.
nonegotiate}
For SFP interfaces, the default setting is no speed nonegotiate,
which sets the speed to the maximum speed and enables link
Example: negotiation for flow-control parameters and remote fault
hostname(config-if)# speed 100 information. The nonegotiate keyword is the only keyword
available for SFP interfaces. The speed nonegotiate command
disables link negotiation.
Step 4 (Optional) Sets the duplex for copper interfaces. The auto setting is the
duplex {auto | full | half} default.
Note The duplex setting for an EtherChannel interface must be
Full or Auto.
Example:
hostname(config-if)# duplex full
Command Purpose
Step 5 (Optional) Enables pause (XOFF) frames for flow control on 1-Gigabit and
flowcontrol send on [low_water high_water 10-Gigabit Ethernet interfaces.
pause_time] [noconfirm] If you have a traffic burst, dropped packets can occur if the burst
exceeds the buffering capacity of the FIFO buffer on the NIC and
Example: the receive ring buffers. Enabling pause frames for flow control
hostname(config-if)# flowcontrol send on can alleviate this issue. Pause (XOFF) and XON frames are
95 200 10000 generated automatically by the NIC hardware based on the FIFO
buffer usage. A pause frame is sent when the buffer usage exceeds
the high-water mark. The default high_water value is 128 KB (10
GigabitEthernet) and 24 KB (1 GigabitEthernet); you can set it
between 0 and 511 (10 GigabitEthernet) or 0 and 47 KB
(1 GigabitEthernet). After a pause is sent, an XON frame can be
sent when the buffer usage is reduced below the low-water mark.
By default, the low_water value is 64 KB (10 GigabitEthernet)
and 16 KB (1 GigabitEthernet); you can set it between 0 and 511
(10 GigabitEthernet) or 0 and 47 KB (1 GigabitEthernet). The link
partner can resume traffic after receiving an XON, or after the
XOFF expires, as controlled by the timer value in the pause frame.
The default pause_time value is 26624; you can set it between 0
and 65535. If the buffer usage is consistently above the high-water
mark, pause frames are sent repeatedly, controlled by the pause
refresh threshold value.
When you use this command, you see the following warning:
Changing flow-control parameters will reset the
interface. Packets may be lost during the reset.
Proceed with flow-control changes?
What to Do Next
Optional Tasks:
• Configure redundant interface pairs. See the “Configuring a Redundant Interface” section on
page 12-26.
• Configure an EtherChannel. See the “Configuring an EtherChannel” section on page 12-28.
• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking”
section on page 12-31.
Required Tasks:
• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC
addresses to context interfaces. See the “Configuring Multiple Contexts” section on page 6-14.
• For single context mode, complete the interface configuration. See Chapter 8, “Completing
Interface Configuration (Routed Mode),” or Chapter 9, “Completing Interface Configuration
(Transparent Mode).”
Prerequisites
• Both member interfaces must be of the same physical type. For example, both must be Ethernet.
• You cannot add a physical interface to the redundant interface if you configured a name for it. You
must first remove the name using the no nameif command.
• For multiple context mode, complete this procedure in the system execution space. To change from
the context to the system execution space, enter the changeto system command.
Caution If you are using a physical interface already in your configuration, removing the name will clear any
configuration that refers to the interface.
Detailed Steps
Command Purpose
Step 1 interface redundant number Adds the logical redundant interface, where the number argument
is an integer between 1 and 8.
Example: Note You need to add at least one member interface to the
hostname(config)# interface redundant 1 redundant interface before you can configure logical
parameters for it such as a name.
Step 2 member-interface physical_interface Adds the first member interface to the redundant interface.
See the “Enabling the Physical Interface and Configuring
Example: Ethernet Parameters” section for a description of the physical
hostname(config-if)# member-interface interface ID.
management 0/0
Redundant interfaces do not support Management slot/port
interfaces as members.
After you add the interface, any configuration for it (such as an IP
address) is removed.
Step 3 member-interface physical_interface Adds the second member interface to the redundant interface.
Make sure the second interface is the same physical type as the
Example: first interface.
hostname(config-if)# member-interface
management 1/0
To remove a member interface, enter the no member-interface
physical_interface command. You cannot remove both member
interfaces from the redundant interface; the redundant interface
requires at least one member interface.
Examples
What to Do Next
Optional Task:
• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking”
section on page 12-31.
Required Tasks:
• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC
addresses to context interfaces. See the “Configuring Multiple Contexts” section on page 6-14.
• For single context mode, complete the interface configuration. See the Chapter 8, “Completing
Interface Configuration (Routed Mode),” or Chapter 9, “Completing Interface Configuration
(Transparent Mode).”
For example:
hostname# show interface redundant1 detail | grep Member
Members GigabitEthernet0/3(Active), GigabitEthernet0/2
where the redundantnumber argument is the redundant interface ID, such as redundant1.
The physical_interface is the member interface ID that you want to be active.
Configuring an EtherChannel
This section describes how to create an EtherChannel port-channel interface, assign interfaces to the
EtherChannel, and customize the EtherChannel.
This section includes the following topics:
• Adding Interfaces to the EtherChannel, page 12-28
• Customizing the EtherChannel, page 12-30
Prerequisites
• All interfaces in the channel group must be the same type, speed, and duplex. Half duplex is not
supported.
• You cannot add a physical interface to the channel group if you configured a name for it. You must
first remove the name using the no nameif command.
• For multiple context mode, complete this procedure in the system execution space. To change from
the context to the system execution space, enter the changeto system command.
Caution If you are using a physical interface already in your configuration, removing the name will clear any
configuration that refers to the interface.
Detailed Steps
Command Purpose
Step 1 interface physical_interface Specifies the interface you want to add to the channel group,
where the physical_interface ID includes the type, slot, and port
number as type[slot/]port. This first interface in the channel group
Example:
hostname(config)# interface
determines the type and speed for all other interfaces in the group.
gigabitethernet 0/0 In transparent mode, if you create a channel group with multiple
Management interfaces, then you can use this EtherChannel as the
management-only interface.
Step 2 channel-group channel_id mode {active | Assigns this physical interface to an EtherChannel with the
passive | on} channel_id between 1 and 48. If the port-channel interface for this
channel ID does not yet exist in the configuration, one will be
Example: added:
hostname(config-if)# channel-group 1 mode interface port-channel channel_id
active
We recommend using active mode. For information about active,
passive, and on modes, see the “Link Aggregation Control
Protocol” section on page 12-6.
Step 3 (Optional) Sets the priority for a physical interface in the channel group
lacp port-priority number between 1 and 65535. The default is 32768. The higher the
number, the lower the priority. The ASA uses this setting to decide
which interfaces are active and which are standby if you assign
Example: more interfaces than can be used. If the port priority setting is the
hostname(config-if)# lacp port-priority same for all interfaces, then the priority is determined by the
12345
interface ID (slot/port). The lowest interface ID is the highest
priority. For example, GigabitEthernet 0/0 is a higher priority
than GigabitEthernet 0/1.
If you want to prioritize an interface to be active even though it
has a higher interface ID, then set this command to have a lower
value. For example, to make GigabitEthernet 1/3 active before
GigabitEthernet 0/7, then make the lacp port-priority value be
12345 on the 1/3 interface vs. the default 32768 on the 0/7
interface.
If the device at the other end of the EtherChannel has conflicting
port priorities, the system priority is used to determine which port
priorities to use. See the lacp system-priority command in the
“Customizing the EtherChannel” section on page 12-30.
Step 4 Repeat steps 1 through 5 for each interface you Each interface in the channel group must be the same type and
want to add to the channel group. speed. Half duplex is not supported. If you add an interface that
does not match, it will be placed in a suspended state.
What to Do Next
Optional Tasks:
• Customize the EtherChannel interface. See the “Customizing the EtherChannel” section on
page 12-30.
• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking”
section on page 12-31.
Required Tasks:
• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC
addresses to context interfaces. See the “Configuring Multiple Contexts” section on page 6-14.
• For single context mode, complete the interface configuration. See the Chapter 8, “Completing
Interface Configuration (Routed Mode),” or Chapter 9, “Completing Interface Configuration
(Transparent Mode).”
Detailed Steps
Command Purpose
Step 1 interface port-channel channel_id Specifies the port-channel interface. This interface was created
automatically when you added an interface to the channel group.
If you have not yet added an interface, then this command creates
Example:
hostname(config)# interface port-channel 1
the port-channel interface.
Note You need to add at least one member interface to the
port-channel interface before you can configure logical
parameters for it such as a name.
Step 2 lacp max-bundle number Specifies the maximum number of active interfaces allowed in the
channel group, between 1 and 8. The default is 8.
Example:
hostname(config-if)# lacp max-bundle 6
Step 3 port-channel min-bundle number Specifies the minimum number of active interfaces required for
the port-channel interface to become active, between 1 and 8. The
default is 1. If the active interfaces in the channel group falls
Example:
hostname(config-if)# port-channel
below this value, then the port-channel interface goes down, and
min-bundle 2 could trigger a device-level failover.
Command Purpose
Step 4 port-channel load-balance {dst-ip | Configures the load-balancing algorithm. By default, the ASA
dst-ip-port | dst-mac | dst-port | balances the packet load on interfaces according to the source and
src-dst-ip | src-dst-ip-port | src-dst-mac
| src-dst-port | src-ip | src-ip-port |
destination IP address (src-dst-ip) of the packet. If you want to
src-mac | src-port | vlan-dst-ip | change the properties on which the packet is categorized, use this
vlan-dst-ip-port | vlan-only | command. For example, if your traffic is biased heavily towards
vlan-src-dst-ip | vlan-src-dst-ip-port | the same source and destination IP addresses, then the traffic
vlan-src-ip | vlan-src-ip-port} assignment to interfaces in the EtherChannel will be unbalanced.
Changing to a different algorithm can result in more evenly
Example: distributed traffic. For more information about load balancing, see
hostname(config-if)# port-channel the “Load Balancing” section on page 12-7.
load-balance src-dst-mac
Step 5 lacp system-priority number Sets the LACP system priority, from 1 to 65535. The default is
32768. The higher the number, the lower the priority. This
command is global for the ASA.
Example:
hostname(config)# lacp system-priority If the device at the other end of the EtherChannel has conflicting
12345 port priorities, the system priority is used to determine which port
priorities to use. For interface priorities within an EtherChannel,
see the lacp port-priority command in the “Adding Interfaces to
the EtherChannel” section on page 12-28.
Step 6 (Optional) This method provides a shortcut to set these parameters because
these parameters must match for all interfaces in the channel
You can set the Ethernet properties for the
group. See the “Enabling the Physical Interface and Configuring
port-channel interface to override the properties
Ethernet Parameters” section on page 12-23 for Ethernet
set on the individual interfaces.
commands.
What to Do Next
Optional Task:
• Configure VLAN subinterfaces. See the “Configuring VLAN Subinterfaces and 802.1Q Trunking”
section on page 12-31.
Required Tasks:
• For multiple context mode, assign interfaces to contexts and automatically assign unique MAC
addresses to context interfaces. See the “Configuring Multiple Contexts” section on page 6-14.
• For single context mode, complete the interface configuration. See the Chapter 8, “Completing
Interface Configuration (Routed Mode),” or Chapter 9, “Completing Interface Configuration
(Transparent Mode).”
• Maximum subinterfaces—To determine how many VLAN subinterfaces are allowed for your
platform, see the “Licensing Requirements for ASA 5510 and Higher Interfaces” section on
page 12-8.
• Preventing untagged packets on the physical interface—If you use subinterfaces, you typically do
not also want the physical interface to pass traffic, because the physical interface passes untagged
packets. This property is also true for the active physical interface in a redundant interface pair.
Because the physical or redundant interface must be enabled for the subinterface to pass traffic,
ensure that the physical or redundant interface does not pass traffic by leaving out the nameif
command. If you want to let the physical or redundant interface pass untagged packets, you can
configure the nameif command as usual. See Chapter 8, “Completing Interface Configuration
(Routed Mode),” or Chapter 9, “Completing Interface Configuration (Transparent Mode),” for more
information about completing the interface configuration.
• (ASA 5512-X through ASA 5555-X) You cannot configure subinterfaces on the Management 0/0
interface.
Prerequisites
For multiple context mode, complete this procedure in the system execution space. To change from the
context to the system execution space, enter the changeto system command.
Detailed Steps
Command Purpose
Step 1 interface {physical_interface | redundant Specifies the new subinterface. See the “Enabling the Physical
number | port-channel number}.subinterface Interface and Configuring Ethernet Parameters” section for a
description of the physical interface ID.
Example: The redundant number argument is the redundant interface ID,
hostname(config)# interface such as redundant 1.
gigabitethernet 0/1.100
The port-channel number argument is the EtherChannel interface
ID, such as port-channel 1.
The subinterface ID is an integer between 1 and 4294967293.
Step 2 vlan vlan_id Specifies the VLAN for the subinterface. The vlan_id is an integer
between 1 and 4094. Some VLAN IDs might be reserved on
connected switches, so check the switch documentation for more
Example:
hostname(config-subif)# vlan 101
information.
You can only assign a single VLAN to a subinterface, and you
cannot assign the same VLAN to multiple subinterfaces. You
cannot assign a VLAN to the physical interface. Each subinterface
must have a VLAN ID before it can pass traffic. To change a
VLAN ID, you do not need to remove the old VLAN ID with the
no option; you can enter the vlan command with a different
VLAN ID, and the ASA changes the old ID.
What to Do Next
(Optional) For the ASA 5580 and 5585-X, enable jumbo frame support according to the “Enabling
Jumbo Frame Support (Supported Models)” section on page 12-33.
Prerequisites
• In multiple context mode, set this option in the system execution space.
• Changes in this setting require you to reload the ASA.
• Be sure to set the MTU for each interface that needs to transmit jumbo frames to a higher value than
the default 1500; for example, set the value to 9000 using the mtu command. See the “Configuring
the MAC Address and MTU” section on page 8-9. In multiple context mode, set the MTU within
each context.
Detailed Steps
Command Purpose
jumbo-frame reservation Enables jumbo frame support for the ASA 5580 and 5585-X. To disable
jumbo frames, use the no form of this command.
Example:
hostname(config)# jumbo-frame reservation
Examples
The following example enables jumbo frame reservation, saves the configuration, and reloads the ASA:
hostname(config)# jumbo-frame reservation
WARNING: this command will take effect after the running-config is saved
and the system has been rebooted. Command accepted.
Monitoring Interfaces
To monitor interfaces, enter one of the following commands:
Command Purpose
show interface Displays interface statistics.
show interface ip brief Displays interface IP addresses and status.
show lacp {[channel_group_number] {counters For EtherChannel, displays LACP information such as traffic statistics,
| internal | neighbor} | sys-id} system identifier and neighbor details.
show port-channel [channel_group_number] For EtherChannel, displays EtherChannel information in a detailed and
[brief | detail | port | protocol | one-line summary form. This command also displays the port and
summary]
port-channel information.
show port-channel channel_group_number For EtherChannel, displays port-channel load-balance information along
load-balance [hash-result {ip | ipv6 | with the hash result and member interface selected for a given set of
l4port | mac | mixed | vlan-only}
parameters]
parameters.
EtherChannel Example
The following example configures three interfaces as part of an EtherChannel. It also sets the system
priority to be a higher priority, and GigabitEthernet 0/2 to be a higher priority than the other interfaces
in case more than eight interfaces are assigned to the EtherChannel.
lacp system-priority 1234
interface GigabitEthernet0/0
channel-group 1 mode active
interface GigabitEthernet0/1
channel-group 1 mode active
interface GigabitEthernet0/2
lacp port-priority 1234
channel-group 1 mode passive
interface Port-channel1
lacp max-bundle 4
port-channel min-bundle 2
port-channel load-balance dst-ip
Where to Go Next
• For multiple context mode:
a. Assign interfaces to contexts and automatically assign unique MAC addresses to context
interfaces. See Chapter 6, “Configuring Multiple Context Mode.”
b. Complete the interface configuration according to Chapter 8, “Completing Interface
Configuration (Routed Mode),” or Chapter 9, “Completing Interface Configuration
(Transparent Mode).”
• For single context mode, complete the interface configuration according to Chapter 8, “Completing
Interface Configuration (Routed Mode),” or Chapter 9, “Completing Interface Configuration
(Transparent Mode).”
Increased VLANs for the ASA 5580 8.1(2) The number of VLANs supported on the ASA 5580 are
increased from 100 to 250.
Support for Pause Frames for Flow Control on 8.2(5)/8.4(2) You can now enable pause (XOFF) frames for flow control
1-Gigabit Ethernet Interfaces for 1-Gigabit interfaces on all models.
We modified the following command: flowcontrol.