Everything I’ve read suggests that I should have the vlan command. I keep thinking there’s a setting somewhere I need to set, or reset.

Thanks for your help.

I bought an old Cisco switch 3524, which is running IOS 12.0(5)WC3b. I am trying to do CCNA labs on VLANs, but I don’t have the vlan command (in config):

Switch(config)#vlan
^
% Invalid input detected at ^ marker.

Switch(config)#v?
vmps vtp

Could this be due to a corrupted IOS, or is there a setting I haven’t learned yet that took it away? I’ve been reading a lot of articles that tell me I should have the command available.

I have erased my config, reload, and deleted vlan.dat.

Thank you again.

Strictly speaking, the recommended replacement for a PIX515e is the ASA5510 and not the 5505. However, if you feel that a 5505 is suitable in terms of performance, connections etc. then go ahead with it. However, you must get a 5505 with a security plus license in case you want to create more than 2 security zones (Vlans). That is, if you want to have an outside vlan, an inside vlan and a third DMZ vlan, then you must get a “Sec Plus” license to avoid any restrictions.

The ASA5505 is not just a NAT firewall. It is a fully functional firewall just like the other ASA models. You can configure any packet filtering scenarios you want. The example you mention with DNS and SMTP is fully supported on the 5505 with no problems.

Let me know if you need more guidance.

Harris

I have been asked to replace our two Cisco PIX 515e firewalls because they are no longer supported.
Please would you advise me on a replacement from the Cisco ASA 5500 series?

I am interested in keeping our costs down so the ASA 5505 looks interesting.

Is the 5505 a NAT firewall only?

We need to do packet filtering between two fully routed subnets.

For example:
block all traffic except allow DNS queries to our DNS nameserver
and allow SMTP traffic to our mail server.

Both of these servers are located on the secure side of our current PIX 515e (external firewall)
which is a boundary between the Internet and our (routed IP subnet) DMZ.

I would be very grateful for some advice and guidance.

Thanks in advance.

Paul Blackburn