I have a FWSM ruuning on a 6509 with MFSC in context mode.
If I configure up a full SVI routed environment on the MFSC to send packets to the FWSM it all works fine.
Howvever if I just have a VLAN to which my incoming traffic comes via a port on the switch and is routed from an attached router device connected to the switch port in the same VLAN directing traffic to the FWSM however I see no traffic crossing the Interface. I can ping from the router on the port to the FWSM ip address and the other way.
I have the Admin context works fine of the same VLAN !
Any ideas what I have missed
YES !! My very first posting asked if you are sharing vlan.
Anyway, yes, with interfaces that you share you need to provide translation.
Can you use another vlan for management and allocate that to the admin context?
1. allocate another vlan to the admin context. This doesn't even have to exist in the siwtch's vlan database.
2. now configure this as another interface in the admin context.
3. configure nat in the admin context as well between these two interface from high to low.
So, classifier can work properly and not get confused as to which context to send the packets that it receives.
You can read about classifier here: http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/configuration/guide/contxt_f.html#wp1124172
Rate the posts that were useful to you and that solved the issue. Pls. make sure to mark the issue resolved if you think it is.
I haven't worked with 4.x code so Kusankar can perhaps confirm but if you have a shared interface you used to have to use NAT rules otherwise the classifier does not know which context to send the traffic to ?