Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

secure vlan

why vlan 1 cannot be secure vlan on 6500+FWSM?

Router#conf

Configuring from terminal, memory, or network [terminal]?

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#firewall vlan-group 1 1-2

Vlan 1 can not be a secure vlan

1 REPLY
Silver

Re: secure vlan

You can think of the FWSM module like an another router (or firewall) controlling its own interfaces on layer-3. This layer-3 router, i.e. the FWSM, now connects on the IP level to the MFSC (via the secure VLAN interfaces - SVI). This means that the MFSC does not control any VLAN, which is dedicated to the FWSM. These VLANs are controlled by the FWSM exclusively, i.e. all traffic sent to any of the firewall controlled VLANs must go across the FWSM. If the MFSC and the FWSM would have a VLAN in common(VLAN1 is default VLAN), traffic might enter this VLAN without being checked by the firewall thereby creating a security hole.

393
Views
0
Helpful
1
Replies
CreatePlease to create content