I have two FWSM's, one each in redundantly connected 6500's. The FWSM's are in multi-context routed mode, and active/active failover.
I have 3 contexts, Admin, students, labs. Each context shares interface vlan925 as the connection to the core for routing. The problem I have is that contexts students and labs each have 20+ interfaces I'm treating as "outside" interfaces, but I want to be able to relay DHCP requests to DHCP servers on the inside which is interface vlan925(the shared interface). This is not allowed because it's a shared interface. I cannot use the firewall as the DHCP server according to other requirements. How can I pass DHCP requests?
I had originally thought to give each context it's own SVI for the inside interface to allow routing to the core, but that doesn't seem to be allowed either.
Core1(config)#firewall vlan-group 1 900,925
Found svi for vlan 900
Found svi for vlan 925
No more than one svi is allowed, command rejected.
By default the FWSM will only allow on vlan with an SVI ie. L3 vlan interface, to be allocated to the firewall module. This is a precautionary measure because if you have multiple vlans that have SVI's on the MSFC you could, if you are not careful route "around" the FWSM from one vlan to another thus defeating the purpose of the FWSM.
However if you enter this command on the 6500 switch
6500(config)# firewall multiple-vlan-interfaces
this will then allow you to assign more than one SVI. As ling as you are careful with your vlan layout it won't be a problem.