Cisco ASA 5506: Configuring the Interfaces to Replace the ASA 5505

Cisco has positioned the 5506x to replace their long time small office firewall, the 5505.  The issue with the Cisco ASA 5506 is that it has separate ports that cannot be turned to switch ports.  This means you can only setup one interface per network.  This has upset many 5505 administrators; now they need at least two devices, a firewall and a switch, to replace the one firewall.

Getting Around the Problem

I have found one way to allow the use of multiple interfaces to the same network using EtherChannels.  I will make the assumption that most people will want to do this for the inside interface.

Step 1) Clear the current inside interface (no nameif inside).

Step 2) Create a port channel:

Step 3) Add the interfaces that you want to share in the inside network to the channel group.  Note I had to use mode on; all the other modes would not come up for a workstation connected into the firewall.

Now you can have up to seven (7) interfaces into the same network and still leave one for the outside connection.  I hope this helps anyone trying to use a Cisco ASA 5506x in place of the 5505.

Jason Howe, PEI