Solved: Multi-context FWSM DHCP Relay Problem

paulhignutt · ‎02-29-2008

I have two FWSM's, one each in redundantly connected 6500's. The FWSM's are in multi-context routed mode, and active/active failover.

I have 3 contexts, Admin, students, labs. Each context shares interface vlan925 as the connection to the core for routing. The problem I have is that contexts students and labs each have 20+ interfaces I'm treating as "outside" interfaces, but I want to be able to relay DHCP requests to DHCP servers on the inside which is interface vlan925(the shared interface). This is not allowed because it's a shared interface. I cannot use the firewall as the DHCP server according to other requirements. How can I pass DHCP requests?

I had originally thought to give each context it's own SVI for the inside interface to allow routing to the core, but that doesn't seem to be allowed either.

Core1(config)#firewall vlan-group 1 900,925

Found svi for vlan 900

Found svi for vlan 925

No more than one svi is allowed, command rejected.

Jon Marshall · ‎02-29-2008

Hi Paul

By default the FWSM will only allow on vlan with an SVI ie. L3 vlan interface, to be allocated to the firewall module. This is a precautionary measure because if you have multiple vlans that have SVI's on the MSFC you could, if you are not careful route "around" the FWSM from one vlan to another thus defeating the purpose of the FWSM.

However if you enter this command on the 6500 switch

6500(config)# firewall multiple-vlan-interfaces

this will then allow you to assign more than one SVI. As ling as you are careful with your vlan layout it won't be a problem.

HTH

Jon

View solution in original post

Jon Marshall · ‎02-29-2008

Hi Paul

By default the FWSM will only allow on vlan with an SVI ie. L3 vlan interface, to be allocated to the firewall module. This is a precautionary measure because if you have multiple vlans that have SVI's on the MSFC you could, if you are not careful route "around" the FWSM from one vlan to another thus defeating the purpose of the FWSM.

However if you enter this command on the 6500 switch

6500(config)# firewall multiple-vlan-interfaces

this will then allow you to assign more than one SVI. As ling as you are careful with your vlan layout it won't be a problem.

HTH

Jon

paulhignutt · ‎02-29-2008

Thanks, I think this will fix my problem.

john.mcmanus · ‎03-01-2008

I believe you will still have a problem relaying DHCP from the 20+ VLAN onto the SVI.

I had hit this problem before. Instead you need to split all the routes back to the core router into seperate Border Vlans.

Hope this help.

Regards

John

john.mcmanus · ‎03-01-2008

What I should have said was, I assume you are using the Firewall to perform DHCP forwarding?

John