Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

New FWSM Installation Clarification

Im installing a new FWSM and I have a couple of questions. Currently I have several VLANs defined with SVI's on my Cat 6500's and they can all pass traffic to one another. Now I need to segment 3 VLANS (Currently Layer3) from each other and everything else. So from my understanding of this statement "For security reasons, by default, only one SVI can exist between the MSFC and the FWSM. For example, if you misconfigure the system with multiple SVIs, you can accidentally allow traffic to pass around the FWSM if you assign both the inside and outside VLANs to the MSFC."

Does this mean that I would....

1. Have a layer 3 vlan on the Cat6500 that would be the inside interface that is attached to the FWSM (this will route traffic from the segmented VLANS)

2. The 3 interfaces that I want segmented I would convert to layer 2 vlans by removing the current SVI's

3. And I would assign all 4 vlans to my firewall vlan-group on the switch?

That is my understanding of this, am I correct?

4 REPLIES
Hall of Fame Super Blue

Re: New FWSM Installation Clarification

1) Not sure about it being the inside interface. Usually the outside interface of the FWSM is on a vlan that the MSFC has a L3 SVI for. So all traffic to any other vlans behind the FWSM are routed by the MSFC to the outside interface of the FWSM.

2) Correct - you remove the SVI's and create interfaces on the FWSM for these vlans.

3) Correct altho if memory serves you don't need to allocate the outside vlan to the FWSM but it doesn't hurt not to as long as this vlan is only used for communication between the MSFC and the FWSM.

Jon

New Member

Re: New FWSM Installation Clarification

Thanks for your reply. Your right about the first part, it would be the outside interface, I was thinking of another scenario here that would require it to be the inside interface. Can you run OSPF on the FWSM? If not would I just use static routes to point the layer3 int on the FWSM for the switch to be able to route traffic?

Hall of Fame Super Blue

Re: New FWSM Installation Clarification

Yes the FWSM will support OSPF. If you do run OSPF make sure you make the OSPF priority on the FWSM interfaces 0 so they cannot become the DR/BDR as if the 6500 switches failover things are a lot quicker.

Alternatively you can just use statics as you say. How you get these statics into the rest of your network is up to you but usually you simply redistribute them into your IGP.

Jon

New Member

Re: New FWSM Installation Clarification

I believe this may be a valid entry point for FWSM adn MSFC: http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/intro_f.html#wp1050383.

Andrea

155
Views
4
Helpful
4
Replies
CreatePlease login to create content