我们正在从 ASA5505 升级到 ASA5506-X，但与 ASA5505 不同的是，新防火墙 ASA5506-X 没有交换机端口，也不支持物理接口上的 vlan。因此，我在其子接口上创建 vlan，为其分配 IP 地址，但它不与终端设备通信，也不使用第 3 层交换机与终端设备进行通信。
基本上，我是直接在asa5506-x的子接口上设置dhcp服务器，但是它没有给电脑分配IP地址（当我将电脑直接连接到asa506-x的接口时），同样的情况使用一台交换机SG500P。
我可以使用 asa5506-x 的路由接口（不是子接口），设置 dhcp 服务器，但随后我无法在其上创建 vlan，因为它是有限的，并且 vlan 仅在此 asa5506 的子接口上受支持-x 防火墙。
即使我们暂时不关心dhcp服务器，我也无法使用子接口的IP地址登录ADSM，但是如果给物理接口一个IP地址，我可以通过ADSM，我可以设置 dhcp 服务器，但在物理接口上又没有 vlan。
运行 ASA 5506-X 的配置（注意：我是初学者，我在测试时知道有些命令可能是错误的）
ASA Version 9.8(1)
!
hostname ASA5506-X-1038
enable password $sha512$5000$d7ukqoZ+VKJqA80su8CGvg==$vvuGumvyoey96hWjvIBCtg== pbkdf2
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.1.2 255.255.255.0
!
interface GigabitEthernet1/3
nameif protrans-int
security-level 100
ip address 192.168.3.3 255.255.255.0
!
interface GigabitEthernet1/3.3
vlan 2
nameif protrans
security-level 100
ip address 192.168.2.3 255.255.255.0
!
interface GigabitEthernet1/4
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
ip address 172.30.30.22 255.255.255.0
!
boot system disk0:/asa981-lfbff-k8.SPA
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj-protrans
subnet 192.168.2.0 255.255.255.0
object network 2
object network real-inside
subnet 192.168.2.0 255.255.255.0
object network mapped-inside
range 192.168.3.0 192.168.3.254
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu protrans 1500
mtu protrans-int 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-781-150.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
nat (any,outside) dynamic interface
object network obj-protrans
nat (protrans,protrans-int) dynamic interface
object network real-inside
nat (protrans,protrans-int) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.3.0 255.255.255.0 protrans-int
http 192.168.2.0 255.255.255.0 protrans
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd auto_config protrans-int
!
dhcpd address 192.168.1.5-192.168.1.254 inside
dhcpd enable inside
!
dhcpd address 192.168.2.5-192.168.2.254 protrans
dhcpd enable protrans
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:d4d1a0e542439235aa114c86f69c683d
请帮助。谢谢！