Solved: FWSM Deployment issue.

chris.duggan · ‎03-13-2007

Hi,

Please see the attached network diagram...

We are looking at a management firewall (admin context) with multiple client firewalls. The management firewall will have a number of management servers that will need to access servers on the client firewalls.

Is this a supported configuration for the FWSM?

At the moment there seem to be routing issues as pings can go from one server to the other but the ping reply is never seen.

Thanks,

Chris

Jon Marshall · ‎03-14-2007

Hi Chris

I'm not completely clear from the diagram on your setup but it is a bit early in the morning and i haven't had my 5 cups of coffee yet :-)

In answer to your question though, yes this is a supported design for the FWSM. You can achieve this in one of 2 ways

1) configure access on each of the client firewalls to allow the management servers access. This means updating access-lists on all contexts if you change or add management servers.

2) Have a shared vlan that all the contexts can access. This works but you have to understand how the FWSM classifier works. On our FSWM's we share the outside vlan but do not use any other shared vlans. As i say tho, you can do this.

The FWSM config guide has a good explanation of how the classifier works

http://www.cisco.com/en/US/products/hw/switches/ps708/products_module_configuration_guide_chapter09186a00802c6418.html#wp1105332

HTH

Jon

View solution in original post

Jon Marshall · ‎03-14-2007