Yes, it works fine. You would need to configure the option on the SUP to allow multiple SVI's to be configured when they are assigned/trunked to the firewall. See here:
http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuratio n/guide/switch_f.html Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS Senior Network Engineer Coleman Technologies, Inc. 954-298-1697 > -----Original Message----- > From: Vikas Sharma [mailto:[EMAIL PROTECTED] > Sent: Thursday, November 15, 2007 6:20 AM > To: Fred Reimer; [email protected]; Oliver Boehmer > (oboehmer) > Subject: Re: [c-nsp] traffic flow in 6500 switch with FWSM > and MPLS VPN > > Hi, > > on the same line i have few more doubts. pls help me to > solve this. > > I have 5 vlans namely data, voice , video and CCTV. Packet > coming out of access switch will go to SVI and then come to > FWSM as firewall-group has been configured. Now I want to > integrate this LAN to my MPLS cloud. I have created two vrf > (one for voice/data and video) and another for CCTV and > importing and exporting to all remote sites. > My question is how does FWSM behave when default gateway is > on MSFC svi (i have created dot1 q interfaces on svi and > assign vrf forwarding to respective interfaces). Since on > svi i have configured vrf forwarding, will FWSM understand > the firewall-group in this case? > > any help is greatly appreciated.... > > Regards > Vikas Sharma > > On 11/12/07, Vikas Sharma <[EMAIL PROTECTED]> wrote: > > Hi, > > Can I configure FWSM as a default gateway for my > internal vlans (similar to HSRP configuration on MSFC for > vlans)? i.e inside packet will first hit fwsm then MSFC !!! > > If u have some doc on this pls share if possible.. > > Regards > > Vikas Sharma > > > > On Nov 7, 2007 7:00 PM, Fred Reimer > <[EMAIL PROTECTED]> wrote: > > > There are many ways that you can configure the > 6500 with a FWSM > and IDSM. It depends on what you want to do > with it. You can > place the MSFC (routing entity) inside or > outside of the FWSM. I > prefer inside unless there is a really good > reason to have it > outside (such as routing sessions to providers, > etc) as you don't > need to secure it quite as much as when it is on > a publically > accessible address. You could also use VRF on > the MSFC and have > one instance on the outside and one on the > inside (or a bunch of > instances and one on each DMZ interface of the > FWSM also). For > the IDSM you also have an option of in-line mode > or not. You > want in-line mode if you want IPS functionality, > and promiscuous > mode if you want IDS functionality. Again, you > can place the > IDSM inside or outside the FWSM, but it really > makes sense to > drop malicious traffic before it even reaches > your FW. Perhaps > have it look like Internet -- IDSM -- MSFC -- > FWSM -- MSFC - > inside networks. You really need to talk to, or > hire, a security > specialist. > > Fred Reimer, CISSP, CCNP > Senior Network Engineer > Coleman Technologies, Inc. > 954-298-1697 > > > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto: [EMAIL PROTECTED] > <mailto:[EMAIL PROTECTED]> ] On Behalf Of > Vikas > Sharma > Sent: Wednesday, November 07, 2007 3:14 AM > To: [email protected]; Oliver Boehmer > (oboehmer) > Subject: [c-nsp] traffic flow in 6500 switch > with FWSM and IDSM > > Hi, > > I have FWSM and IDSN-2 on 6500 switch. Since I > am not a security > guy I am > not able to visualize how traffic flow will take > place in this > situation. My > requirement is to secure internal traffic from > external / DMZ > traffic and > inspect malicious traffic. Can someone give me > the logical > picture how > packet will flow inside 6500 switch? whether it > will first go to > FWSM then > to MSFC or first to MSFC then firewall? I have > vlan (SVIs) > created on msfc > and these ips are default gateway for my > internal traffic. > > Any help is appreciated... > > Regards > Vikas Sharma > > _______________________________________________ > cisco-nsp mailing list cisco- > [EMAIL PROTECTED] > https://puck.nether.net/mailman/listinfo/cisco- > nsp <https://puck.nether.net/mailman/listinfo/cisco-nsp> > archive at > http://puck.nether.net/pipermail/cisco-nsp/ > > >
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
