FWSM and multiple-vlan-interface

Answered Question
Feb 17th, 2009

We are using a CAT 6500 with a FWSM. I need to know if, by enabling multiple-vlan-interface on the switch, will that force vlans from one firewall-group to pass thru the FWSM to reach vlans on another firewall-group (all vlans defined in the same mfsc)?

Or will traffic from all of the non-firewall VLANs in the switch be routed through the MSFC without being stopped by the firewall, even if these vlans are defined in different firewall-groups?

Thanks for your input.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
anniet Wed, 02/18/2009 - 08:20

Thanks Jon,

I guess that is why I read "some PBR may be required". I have about 5 vlans in the server farm and I want all traffic going to the server farm to be firewalled. We were thinking about grouping the server farm's vlans into a VRF to make sure all traffic goes thru the FWSM. Does that sound good or do you have any other suggestions?



Jon Marshall Wed, 02/18/2009 - 09:53


You could either

1) use a VRF for the servers as you say


2) create an interface for each server vlan on the FWSM so in effect each server vlan gets it's own DMZ. If you don't want to firewall the traffic from one server vlan to another then you can use

"permit ip any any" between the server vlans.

Each of these server vlans must not have a L3 SVI on the MSFC ie. their default-gateway per vlan is an interface on the FWSM. So the only way to get to them is via the FWSM.

Out of the 2 options i have only deployed option 2 so i can't say what gotcha's there will be with the VRF solution.

Also worth bearing mind. If there is a lot of traffic flowing between these server vlans then the VRF approach may be a better approach because this traffic can be routed via the MSFC rather than have to go through the FWSM and only traffic from non-server vlans would have to go through the FWSM.

Does this make sense ?


anniet Wed, 02/18/2009 - 14:20


Thanks for your input. It helped us confirm our thoughts. I actually lied earlier about the 5 vlans in the server farm, we have 24. Ridiculous I know, but that's the network setup I inherited.

No way we are going to define all those interfaces in the FWSM, and like you mentionned, we don't really want to firewall between those vlans, so VRF is how we are going to group them.



Jon Marshall Wed, 02/18/2009 - 14:41


"I actually lied earlier about the 5 vlans in the server farm, we have 24."

Ah well then i agree you should look into VRF. Hope it goes well.



This Discussion