Thanks, I believe I have it setup properly, but how do you setup a interface for the inside vlan. The outside vlan is the vlan on the MSFC, but where do you configure the interface for the inside vlan interface? Also from inside when i try to ping I get ????? any reason why?

did you inlcude that vlan in the fwsm?

like this on the 6500 box

firewall module 1 vlan-group 1

firewall vlan-group 1 96-990

and than created that vlan on the fwsm?

Yes, I did that. Maybe I am asking the wrong question. I am use to setting up PIX 515e, You have E0 and E1. Each interface is designated to be inside or outside. When using the 6509 the SVI, I am assuming is the outside interface.

What is the inside interface? and How is it configure to specify an interface?

The SVI on your MSFC is not the outside interface of your FWSM. It should look something like this

MSFC SVI (192.168.2.1) -> (192.168.2.2) outside FWSM inside (192.168.3.1 )

The outside interface of your FWSM is in the same vlan as the MSFC SVI. The inside interface is only on the FWSM ie. there is no L3 SVI for the inside interface.

As for creating the outside and inside interfaces you would do this on the FWSM and is very similiar to what you would do on a standalone device. Attached is a basic getting started guide for the FWSM.

http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00808b4d9f.shtml

Jon

So, does the whole switch with the exception of the outside interface SVI, become the inside vlan?

How do you add systems to the inside vlan?

"So, does the whole switch with the exception of the outside interface SVI, become the inside vlan?"

No it doesn't. The inside vlan is simply the vlan you have allocated to the inside interface on your FWSM.

So lets say you have vlans 10 - 20 on your 6500.

Until you allocate any of these vlans to the FWSM with the firewall vlan-group ... command they are just vlans on the 6500, nothing to do with the FWSM.

If you then allocate vlan 11 as the inside vlan on the FWSM then all the other vlans 10,12 - 20 are still vlans on the 6500, nothing to do with the FWSM.

You add systems to the inside vlans by simply adding ports into that vlan. So if you have connected 2 servers to gi2/1 & gi2/1

6500(config)# int range gi2/1 - 2

6500(config-if)# switchport access vlan 11

These servers are now in vlan 11 and will be on the inside vlan of the FWSM.

Jon

Got you, man thanks.

So what you are saying is the vlan 11 will not have a SVI right?

Correct, vlan 11 will not have an SVI on the 6500. This applies to all interfaces on the FWSM ie. DMZ's etc. except for the outside interface in your scenario which will have a L3 SVI on the 6500.

Jon

So if I do a sh vlan on the MSFC, should I see the "inside" vlan listed?

I turned on rip passive and default on the inside, but I am not able to ping any systems on the inside. Any reason why?