cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
413
Views
4
Helpful
4
Replies

New FWSM Installation Clarification

thefindjack
Level 1
Level 1

Im installing a new FWSM and I have a couple of questions. Currently I have several VLANs defined with SVI's on my Cat 6500's and they can all pass traffic to one another. Now I need to segment 3 VLANS (Currently Layer3) from each other and everything else. So from my understanding of this statement "For security reasons, by default, only one SVI can exist between the MSFC and the FWSM. For example, if you misconfigure the system with multiple SVIs, you can accidentally allow traffic to pass around the FWSM if you assign both the inside and outside VLANs to the MSFC."

Does this mean that I would....

1. Have a layer 3 vlan on the Cat6500 that would be the inside interface that is attached to the FWSM (this will route traffic from the segmented VLANS)

2. The 3 interfaces that I want segmented I would convert to layer 2 vlans by removing the current SVI's

3. And I would assign all 4 vlans to my firewall vlan-group on the switch?

That is my understanding of this, am I correct?

4 Replies 4

Jon Marshall
Hall of Fame
Hall of Fame

1) Not sure about it being the inside interface. Usually the outside interface of the FWSM is on a vlan that the MSFC has a L3 SVI for. So all traffic to any other vlans behind the FWSM are routed by the MSFC to the outside interface of the FWSM.

2) Correct - you remove the SVI's and create interfaces on the FWSM for these vlans.

3) Correct altho if memory serves you don't need to allocate the outside vlan to the FWSM but it doesn't hurt not to as long as this vlan is only used for communication between the MSFC and the FWSM.

Jon

Thanks for your reply. Your right about the first part, it would be the outside interface, I was thinking of another scenario here that would require it to be the inside interface. Can you run OSPF on the FWSM? If not would I just use static routes to point the layer3 int on the FWSM for the switch to be able to route traffic?

Yes the FWSM will support OSPF. If you do run OSPF make sure you make the OSPF priority on the FWSM interfaces 0 so they cannot become the DR/BDR as if the 6500 switches failover things are a lot quicker.

Alternatively you can just use statics as you say. How you get these statics into the rest of your network is up to you but usually you simply redistribute them into your IGP.

Jon

andrea.meconi
Level 2
Level 2

I believe this may be a valid entry point for FWSM adn MSFC: http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/intro_f.html#wp1050383.

Andrea

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: