Unanswered Question
Sep 24th, 2007

Hi All,

I have the following scenario. We have 2 6509s running HSRP on the distribution layer. These 2 boxes are connected using Layer 2 links to the access switches.

One of the access switches is also a 6509 and it needs to be firewalled off from the rest of the network.

I am debating whether to buy a pair of FWSM modules or go with a pair of ASAs. Also, we are running EIGRP between the distribution and core.

If I go with FWSMs for the distribution 6509, will it be better to place the MSFC inside or outside?


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Mon, 09/24/2007 - 09:51


A lot depends on your future requirements and the throughput you need. For raw throughput the FWSM is the one to go with.

If you can see in future a need to firewall many different vlans within your 6500 infrastructure, again FWSM's could be the better option.

But they are expensive and to simply firewall off one switch it is a costly option.

You should place the MSFC in front of the FWSM ie. any vlans you want to firewall should have their L3 interface on the FWSM.




This Discussion