Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Problem with FWSM and L3 interface in same switch

I have two 6513s with an 802.1q trunk connecting them. Each switch has redundant Sup720s running in Native mode, IOS ver 12.2(18)SXF (they were initially running SXD3). A FWSM (ver 2.3(3), routed mode, single context) is in each switch, setup in failover mode.

I can not get a PC, in a vlan that has the layer 3 interface defined on the switch with the active FWSM in it, to communicate with devices "behind" the FWSM. If I move the layer 3 configuration for that vlan to the other 6513, everything works fine.

The MSFCs are on the inside of the firewall, they have a layer 3 interface configured in the same vlan as the FWSM "inside" interface. Several "same security level" interfaces are defined on the FWSM and used to protect server farms. I am using OSPF on the MSFCs and FWSM and the routing table is correct.

The FWSM builds connections for attempts made by the PC with the layer 3 interface defined on the same switch as the active FWSM just fine, so this is not a FWSM ACL problem.

A ping of the FWSM "inside" interface from a PC with the layer 3 interface defined on the same switch as the active FWSM fails, even though debug icmp trace on the FWSM shows the request and the response. A packet capture, using the NAM-2, shows only the request packets. I have captured on the common vlan and the FWSM backplane port channel interface.

Just to add to the confusion, if I capture in the same places, but do the ping from a PC that is in a vlan with the layer 3 interface defined in the 6513 that does not contain the active FWSM, which works fine, I see the request and reply on the common vlan capture, but only the request on the port channel capture.

This problem has been there from the beginning of this implementation and has not changed with IOS and FWSM software upgrades. I have experienced this with any and all vlans that I tried to define the layer 3 interface for on the switch with the active FWSM. I have MLS turned on.

If anyone else has experienced this and solved it, or knows what is going on, I would appreciate any insight.

Thanks.

Keith

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: Problem with FWSM and L3 interface in same switch

Keith, are you running distributed etherchannel on your 6513's?

3 REPLIES
New Member

Re: Problem with FWSM and L3 interface in same switch

Keith, are you running distributed etherchannel on your 6513's?

New Member

Re: Problem with FWSM and L3 interface in same switch

Hello pallette,

Yes I am using DEC over three 6748 cards with DFCA modules.

Thanks.

Keith

New Member

Re: Problem with FWSM and L3 interface in same switch

Thanks to the question asked by pallette, I ran across this; Field Notice: FN - 61935 - Catalyst 6500 Series and 7600 Series Service Module Incompatibility With Distributed EtherChannel and Packet Re-Circulation which references bug CSCee10005. I have implemented one of the workarounds, I moved all my etherchannel connections to a single board on each switch. At this point, that appears to have solved my problem. Thank you pallette for planting the seed.

123
Views
0
Helpful
3
Replies