Configuration of the FWSM / PIX Blade

[j.damsgaard]

I have searched high and low for a document which gives me a deeper understanding on configuring the FWSM together with the MSCF3 in my 6509 Switch.

Where is the Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module Installation and Configuration Guide. ???

I can only find til Catalyst 6500 Series and Cisco 7600 Series Firewall Services Module Installation and Configuration Note. I suspect they are the same.

The Note only have very few and in my opnion insufficient configuration examples.

If any of You, have a link to a usefull document I would be thankfull.

[nkhawaja]

hi,

Here are some of the links

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/cfgnotes/fwsm/

http://www.cisco.com/en/US/partner/products/hw/switches/ps708/products_installation_and_configuration_guide_chapter09186a0080159cab.html#97331

http://www.cisco.com/en/US/products/hw/modules/ps2706/products_qanda_item09186a00800c4fee.shtml

http://www.cisco.com/en/US/partner/products/hw/switches/ps708/products_installation_and_configuration_guide_chapter09186a0080159caa.html#16069

http://www.cisco.com/application/pdf/en/us/guest/products/ps708/c1679/ccmigration_09186a00801dfe9f.pdf

[shamilton-wilkes]

I found this to be the most useful doc:

http://www.cisco.com/application/pdf/en/us/guest/netsol/ns304/c649/ccmigration_09186a008014efaf.pdf

Simon

[j.damsgaard]

Hello Simon

Thanks for taking time to reply to my answer, I can tell you that I in the meantime have my FWSM Module configurede and up and running.

I will use you link as a refrence dokument to verify my configuration

Jesper Damsgaard

[azharmd]

Hi,

It seems to you have enough hands with switch as of now ? I would appreciate if you could assist me for the below request .

I have an task to configure FWSM in 6509 module with MSFC-Inside , i found the problem with ping from inside zone to DMZ (vice versa) and various DMZ's ... I have an ATM Flex module using PVC's in one VLAN while segregated with IP Segments .. and i want to enforce the seperate policy for individual segment. any valuable suggestions or links would be highly appreciated...

you can reach me at mazhar@ebttikar.com ....i appreciate your earliest feedback

[nkhawaja]

can't say anything without more details. configs and syslog needed.

[j.damsgaard]

Hello mazhar

Are your still have problems, with your FWSM.

Let's take one thing at a time.

Do you have an acess-list on the inside interface, it's requied, to allow ping your could use the following acl's:

Inside interface

access-list inside permit icmp any any echo

access-list inside permit icmp any any echo-reply

access-list inside deny ip any any

access-group inside in in inside

DMZ interface(s)

access-list dmz permit icmp any any echo

access-list dmz permit icmp any any echo-reply

access-list dmz deny ip any any

access-group dmz in in dmz

This setup combined with your exsisting ACL's will allow ping between your inside interface and your dmz's and vice-versa.

This should solve your ping problems, I can't help you with ATM setup, we do not use ATM direkt in our

6509.

Jesper Damsgaard

Bankdata