We are using a CAT 6500 with a FWSM. I need to know if, by enabling multiple-vlan-interface on the switch, will that force vlans from one firewall-group to pass thru the FWSM to reach vlans on another firewall-group (all vlans defined in the same mfsc)?
Or will traffic from all of the non-firewall VLANs in the switch be routed through the MSFC without being stopped by the firewall, even if these vlans are defined in different firewall-groups?
I guess that is why I read "some PBR may be required". I have about 5 vlans in the server farm and I want all traffic going to the server farm to be firewalled. We were thinking about grouping the server farm's vlans into a VRF to make sure all traffic goes thru the FWSM. Does that sound good or do you have any other suggestions?
2) create an interface for each server vlan on the FWSM so in effect each server vlan gets it's own DMZ. If you don't want to firewall the traffic from one server vlan to another then you can use
"permit ip any any" between the server vlans.
Each of these server vlans must not have a L3 SVI on the MSFC ie. their default-gateway per vlan is an interface on the FWSM. So the only way to get to them is via the FWSM.
Out of the 2 options i have only deployed option 2 so i can't say what gotcha's there will be with the VRF solution.
Also worth bearing mind. If there is a lot of traffic flowing between these server vlans then the VRF approach may be a better approach because this traffic can be routed via the MSFC rather than have to go through the FWSM and only traffic from non-server vlans would have to go through the FWSM.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in HA
DocumentationCode download linksGoalRequirementLimitationsSupported ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and UCS-E Blades:Step by Step ConfigurationCo...
I am currently unable to specify "crypto keyring" command when configuring VPN connection on my cisco 2901 router.
The following licenses have been activated on my router :