Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

simple firewall question

hi! We've a fwsm module in our core sw and i'm new to this. just want to find out what's the purpose of the bridge-group 1 command on the inside and outside interfaces? + what's the BVI1 for? is it related to the brige-group 1 command on the inside n outside command? can i have different bridge-group number for inside and outside? thx

interface Vlan100

nameif outside

bridge-group 1

security-level 0

interface BVI1

ip address 10.10.10.1 255.255.255.0

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: simple firewall question

dkblee@hotmail.com

hi! We've a fwsm module in our core sw and i'm new to this. just want to find out what's the purpose of the bridge-group 1 command on the inside and outside interfaces? + what's the BVI1 for? is it related to the brige-group 1 command on the inside n outside command? can i have different bridge-group number for inside and outside? thx

interface Vlan100

nameif outside

bridge-group 1

security-level 0

interface BVI1

ip address 10.10.10.1 255.255.255.0

This configuration is for when you run the FWSM in transparent mode. With transparent mode the IP subnet is the same on the outside and the inside. You use 2 vlans, one for the outside and one for the inside but as i say they both use the same IP subnet.

You then join (ie. bridge) the 2 vlans together with the FWSM. So the bridge group needs to match so the FWSM knows which vlans to join together. The BVI is management IP for this transparent firewall.

Jon

1 REPLY
Hall of Fame Super Blue

Re: simple firewall question

dkblee@hotmail.com

hi! We've a fwsm module in our core sw and i'm new to this. just want to find out what's the purpose of the bridge-group 1 command on the inside and outside interfaces? + what's the BVI1 for? is it related to the brige-group 1 command on the inside n outside command? can i have different bridge-group number for inside and outside? thx

interface Vlan100

nameif outside

bridge-group 1

security-level 0

interface BVI1

ip address 10.10.10.1 255.255.255.0

This configuration is for when you run the FWSM in transparent mode. With transparent mode the IP subnet is the same on the outside and the inside. You use 2 vlans, one for the outside and one for the inside but as i say they both use the same IP subnet.

You then join (ie. bridge) the 2 vlans together with the FWSM. So the bridge group needs to match so the FWSM knows which vlans to join together. The BVI is management IP for this transparent firewall.

Jon

164
Views
0
Helpful
1
Replies
CreatePlease to create content