Step 2. Create Subinterfaces for Each VLAN on Gig1/9
For each VLAN that you have configured on the access point, you need to configure a
subinterface of Gig1/9. In this example configuration, you add two subinterfaces:
-Gig1/9.5, which will have nameif vlan5, and will correspond to VLAN 5 and subnet 10.5.0.0/24.
-Gig1/9.30, which will have nameif vlan30, and will correspond to VLAN 30 and subnet
10.3.0.0/24.
In practice, it is essential that the VLAN and subnet configured here match the VLAN and subnet
specified on the access point. The nameif and subinterface number can be anything you choose.
Please refer to the quick start guide previously mentioned for links in order to configure the
access point using the web GUI.
ciscoasa(config)# interface g1/9.5
ciscoasa(config-if)# vlan 5
ciscoasa(config-if)# nameif vlan5
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 10.5.0.1 255.255.255.0
ciscoasa(config-if)# interface g1/9.30
ciscoasa(config-if)# vlan 30
ciscoasa(config-if)# nameif vlan30
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 10.30.0.1 255.255.255.0
Step 3. Designate a DHCP pool for each VLAN
Create a separate DHCP pool for each VLAN being configured. The syntax for this command
requires that you list the nameif out of which the ASA will serve the pool in question. A seen in this
example, which uses VLANs 5 and 30:
ciscoasa(config)# dhcpd address 10.5.0.2-10.5.0.254 vlan5
ciscoasa(config)# dhcpd address 10.30.0.2-10.30.0.254 vlan30
ciscoasa(config)# dhcpd enable vlan5
ciscoasa(config)# dhcpd enable vlan30
Step 4. Configure the Access Point SSIDs, save the config, and reset the module
Finally, the access point needs to be configured to correspond to the ASA's configuration. The
GUI interface for the access point allows you to configure VLANs on the AP via the client
connected to the ASA inside (Gigabit1/2) interface. However, if you prefer to use CLI to configure
the AP via the ASA console session and then connect wirelessly to manage the AP, you can use
this configuration as a template for creating two SSIDs on VLANs 5 and 30. This must be entered
within the AP console in global configuration mode:
dot11 vlan-name VLAN30 vlan 30
dot11 vlan-name VLAN5 vlan 5
!
dot11 ssid SSID_VLAN30
vlan 30
authentication open
mbssid guest-mode
!
dot11 ssid SSID_VLAN5
vlan 5
authentication open
mbssid guest-mode
!
