FWSM context - Admin Down Interface has traffic stats
I have noticed that one of my firewall contexts interfaces shows input and output packets even though the interface was in the admin shutdown state during reboot.
Interface Vlan111 "DMZ-NET", is administratively down, line protocol is down Description: Interface routing to DMZ-NET (Also used for Context Management) MAC address 0021.55be.8100, MTU 1500 IP address 192.168.4.254, subnet mask 255.255.255.0 Traffic Statistics for "DMZ-NET": 45377 packets input, 3779957 bytes 1130 packets output, 79010 bytes 1999 packets dropped
The FWSM is running v3.1(7) and is a failover pair (The standby also has traffic stats). Do I have to admin shut the interface in the system context to properly close the interface during boot? Is there something in the way that the FWSM loads its system context configuration first and then loads the individual contexts later that means the interface could be live for a few seconds?
This issue became apparent after reloading the FWSM during some failover testing prior to deploying it on the network. These switches and FWSMs are cabled to the existing network (with the IPs of the devices they will replace) and it had put a MAC entry in another firewall device which caused an outage. The reason for keeping the interfaces in the admin shutdown state was to avoid anything like this happening.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...