Anthony
Apologies for the delay in replying.
"I don't believe transparent will work for this situation because in the docs it mentions that you can not have any secondary networks on the inside. So I think that rules it out."
You can create multiple bridge groups however with the future in mind and the flexibility of routed mode i would go with routed in the interim. As your multi-context design shows you can mix and match routed/transparent. More on the multi-context later.
"That leaves me with routed mode. I don't think I can place an SVI (MSFC) on the outside because I will have traffic bypassing the firewall to my SVIs on the inside"
Correct. As long as you have SVI's on the MSFC for your server vlans then you cannot have another SVI for the outside or as you say traffic will just route around your FWSM. This also applies to your multi-context design UNLESS you migrate the L3 SVI's to the FWSM itself, something which isn't proposed in your designs as far as i can see. A common design is to have a vlan that connects the MSFC to the outside of the FWSM and then all the protected vlans only have interfaces on the FWSM and not on the MSFC. This design though presupposes you want to firewall each vlan whereas even in your multi-context design you don't seem to want to do that. Note none of what i am saying is criticism, i'm just trying to get the full picture.
There is nothing wrong with your proposed interim design except that i would recommend having a dedicated vlan from the FWSM to the MSFC on the inside rather than use one of your server vlans so you end up with
v10 -> FWSM -> v100 -> MSFC -> vlans 2, 3, 4.
where vlan 100 is the new vlan purely for FWSM to MSFC connectivity.
"Is this solution legal. Will traffic bypass the FWSM. Can you think of any drawbacks"
Legal may not be the best word :-), it is valid and it will work. Traffic cannot bypass the FWSM because
1) to get to vlan 20 you have to go to the outside of your FWSM
2) to get to any of the inside vlans from either the outside or the DMZ you have to go to the FWSM.
Obviously traffic is unrestricted between vlan 2,3.4.
Be aware that with standalone PIX/ASA devices traffic is allowed from a higher to a lower security interface without an access-list. This is not the case with the FWSM so you would also need an acl on the inside interface ie. vlan 100 or vlan 2 depending on which you go with.
Can't see any major drawbacks assuming your existing setup works as you are just doing a straight swap to the FWSM.
Multi-context design.
Firstly your design shows different vlans on the outside. A perfectly acceptable alternative is to use the same vlan for all your contexts on the outside. This would negate the need for subinterfaces on the 7200. One caveat with that statement. I have deployed the FWSM in this way with multiple contexts in data centres but i have never had a mix of routed/transparent. All my contexts were routed, so i can't say 100% that it would work with transparent as well. Perhaps you could test ?
Only other thing i would add is that you can also if needed mix and match whether the MSFC is on the inside or the outside per context so you may want to factor this in just in case you weren't aware of it.
Overall there is nothing wrong with what you are proposing but please come back with more questions if needed. The FWSM gives you great flexibility in how to deploy firewalling services and the ease with which it integrates with the 6500.
Jon
