Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

FWSM and multiple-vlan-interface

We are using a CAT 6500 with a FWSM. I need to know if, by enabling multiple-vlan-interface on the switch, will that force vlans from one firewall-group to pass thru the FWSM to reach vlans on another firewall-group (all vlans defined in the same mfsc)?

Or will traffic from all of the non-firewall VLANs in the switch be routed through the MSFC without being stopped by the firewall, even if these vlans are defined in different firewall-groups?

Thanks for your input.

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: FWSM and multiple-vlan-interface

6 REPLIES
Hall of Fame Super Blue

Re: FWSM and multiple-vlan-interface

New Member

Re: FWSM and multiple-vlan-interface

Thanks Jon,

I guess that is why I read "some PBR may be required". I have about 5 vlans in the server farm and I want all traffic going to the server farm to be firewalled. We were thinking about grouping the server farm's vlans into a VRF to make sure all traffic goes thru the FWSM. Does that sound good or do you have any other suggestions?

Thanks,

Annie

Hall of Fame Super Blue

Re: FWSM and multiple-vlan-interface

Annie

You could either

1) use a VRF for the servers as you say

OR

2) create an interface for each server vlan on the FWSM so in effect each server vlan gets it's own DMZ. If you don't want to firewall the traffic from one server vlan to another then you can use

"permit ip any any" between the server vlans.

Each of these server vlans must not have a L3 SVI on the MSFC ie. their default-gateway per vlan is an interface on the FWSM. So the only way to get to them is via the FWSM.

Out of the 2 options i have only deployed option 2 so i can't say what gotcha's there will be with the VRF solution.

Also worth bearing mind. If there is a lot of traffic flowing between these server vlans then the VRF approach may be a better approach because this traffic can be routed via the MSFC rather than have to go through the FWSM and only traffic from non-server vlans would have to go through the FWSM.

Does this make sense ?

Jon

New Member

Re: FWSM and multiple-vlan-interface

Jon,

Thanks for your input. It helped us confirm our thoughts. I actually lied earlier about the 5 vlans in the server farm, we have 24. Ridiculous I know, but that's the network setup I inherited.

No way we are going to define all those interfaces in the FWSM, and like you mentionned, we don't really want to firewall between those vlans, so VRF is how we are going to group them.

Regards,

Annie

Hall of Fame Super Blue

Re: FWSM and multiple-vlan-interface

Annie

"I actually lied earlier about the 5 vlans in the server farm, we have 24."

Ah well then i agree you should look into VRF. Hope it goes well.

Jon

Hall of Fame Super Blue
255
Views
0
Helpful
6
Replies
CreatePlease to create content