Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

FWSM in transparent mode

Attempting to set up the FWSM in transparent mode (single context).  Here is my scenario:  I have a 6509 with 3 VLANs…40 (DMZ), 41 (Staff), and 42 (Inside).  I would like to use the FWSM to control access transparently between the 3 VLANs.

Here is what I have set up:

6509

firewall multiple-vlan-interfaces

firewall module 7 vlan-group 40

firewall vlan-group 40  40-42

interface Vlan40

ip address 10.40.0.1 255.255.255.0

!

interface Vlan41

ip address 10.41.0.1 255.255.255.0

!

interface Vlan42

ip address 10.42.0.1 255.255.255.0

!

FWSM

FWSM Version 3.1(10)

firewall transparent

!

interface Vlan40

nameif DMZ

bridge-group 1

security-level 0

!

interface Vlan41

nameif Staff

bridge-group 2

security-level 50

!

interface Vlan42

nameif Inside

bridge-group 3

security-level 100

!

access-list DENY-ALL extended deny ip any any log

access-list DENY-ALL extended deny icmp any any log

access-group DENY-ALL in interface DMZ

I understood that without any ACLs, the default action would be deny, however I was able to communicate freely between all the VLANs.  I added the ACL to explicitly deny anything from the DMZ, but still able to communicate.

Would appreciate any assistance in how I can get the FWSM in transparent mode to control traffic between 3 VLANs.

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: FWSM in transparent mode

Vlan 40 and 41 should be in the same subnet.

But hosts on switchports vlan access 40 and 41 will go through the FWSM that will be bridging these vlans.

So make sure you have 2 ports with hosts in each vlan and that their ip addresses are in the same subnet.

try pinging between them and then the FWSM should be bridging and you will see traffic through it.

I hope it helps.

PK

5 REPLIES
Cisco Employee

Re: FWSM in transparent mode

New Member

Re: FWSM in transparent mode

I "think" I followed the instructions ... placing two VLANs in a single bridge_group (although that goes against everything I believe about routing!) ... but still can not seem to control access between VLAN 40 & 41.  I still have full access between devices on both subnets.

interface Vlan40
nameif DMZ
bridge-group 1
security-level 0
!
interface Vlan41
nameif Schools
bridge-group 1
security-level 50
!
access-list DENY-ALL extended deny ip any any log
access-list DENY-ALL extended deny icmp any any log
access-group DENY-ALL in interface DMZ

Appriciate any advice.

Cisco Employee

Re: FWSM in transparent mode

Vlan 40 and 41 should be in the same subnet.

But hosts on switchports vlan access 40 and 41 will go through the FWSM that will be bridging these vlans.

So make sure you have 2 ports with hosts in each vlan and that their ip addresses are in the same subnet.

try pinging between them and then the FWSM should be bridging and you will see traffic through it.

I hope it helps.

PK

New Member

Re: FWSM in transparent mode

Thank you...that was my misunderstanding.  Both VLANs are using the same subnet linked back together by the bridge-group --- the pieces all fit now!

Cisco Employee

Re: FWSM in transparent mode

Yup, glad it helped.

PK

2560
Views
0
Helpful
5
Replies
CreatePlease to create content