ACE and FWSM Deployment design

Unanswered Question
Sep 1st, 2007


I have a new deployment with FWSM in single context and ACE in multiple context. I need actually 3 contexts. what is the best mode of deployment of FWSm with ACE. I want to have the gateway of all real servers as the Firewall.

shall it be something like this - MSFC-> Fwsm -> ACE -> Real servers.

what mode the FWSM should be?

with regards


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
Jon Marshall Sun, 09/02/2007 - 03:44


If you want to have the gateway of all the real servers as the FWSM then you should use the FWSM in routed mode and the ACE module in bridged mode.

You should look to match contexts if you can depending on licenses/cost ie. one firewall context to one ACE module context.



sathappan Sun, 09/02/2007 - 05:58

Hi Jon,

Thanks for the information. What about the Trasparent Mode ?. will it help me in anyway?

with regards


rkumares Sun, 09/02/2007 - 06:05


I have a clarification.Why do we need to match FWSM context to ACE context.


MSFC--Routed Mode--FWSM---Bridged Mode( multiple VLANs)---ACE (multiple context)

lets say FWSM uses one context.ACE uses 3 context.FWSM to ACE in bridged mode.Is it not possible?

Jon Marshall Sun, 09/02/2007 - 08:28


You don't need to match FWSM contexts to ACE contexts. You are quite right in what you say in that you could use one routed context on the FWSM use different interfaces in that context for each ACE context.

It all depends on hwo you want to organise it. For example it could be argued that having matching contexts allows for easier adminstration having both the FW ruleset and the ACE rules "tied" to each other. Also if you have separate depts. managing their firewalls/load balancers contexts are the way to go.

As i said before it often comes down to licenses/cost but yes it is possible to use only one FWSM context.


rkumares Sun, 09/02/2007 - 08:33

Hi jon,

Thanks for your vlauable response. We will test and update it here


Jon Marshall Sun, 09/02/2007 - 08:25


If you want the gateway to be on the firewall for the servers then you can't use transparent mode. If you do then your gateway would need to be either the MSFC or maybe the ACE module itself and insert the FWSM in transparent mode between the real servers and the gateway on the FWSM.

I haven't used it in that way so if you are looking to go this way i would stringly suggest testing.


dtochilovsky Mon, 04/07/2008 - 08:52

Hello Jon, are there any docs available that describe the setup of the FWSM in routed mode, and the ACE in bridged mode?

I found a few but they have not had the detail I was looking for.

Thank you.


followurself Fri, 09/12/2008 - 08:27

did you guys find anything. i deployed this design msfc-fwsm (routed and gateway)--ace (bridge)---hp enclosers with servers

the prblm i m facing i have to do client based nat on bridge interface facing servers or else the traffic goes to FWSM without being intercepted by ACE. dont want to do any nat.

any ideas


This Discussion