Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CSM RHI interaction with NAT on FWSM

assuming this arrangement in Aggregation/Distribution layer chassis:

to core layer

| (L3 p-t-p /30 net)


| (shared firewall outside vlan)

FWSM (routed mode context)

| (CSM client vlan = fw inside vlan)

CSM (bridge mode)

| (CSM server vlan)

layer-2 access vlan

if we want to use private addresses on the CSM server vlan and have route health injection (RHI) on CSM inject static routes onto MSFC routing process, then the NAT needs to happen up at the MSFC.

Or is there another way?

Question 1: is there any way to have RHI inject an alternate vserver address corresponding to pre-static-NAT address on FWSM?

Question 2: If I have a vserver on CSM with VIP A and TCP port X and another vserver with VIP A and TCP port Y, doesn't RHI mask the availability at the port level since RHI and routing and don't track transport layer ports?

Cisco Employee

Re: CSM RHI interaction with NAT on FWSM

the trick is to configure fake vserver on the csm with the fwsm nat address and use the same serverfarm with the advertise command.

Like this the CSM will insert a route to the correct address.

The FWSM will nat the traffic and send it to the correct vserver [not the one with the nated address].

I didn't try it myself, but I have seen some people doing it.