Hi Fred, The link shows me the option of configuring multiple SVIs but my question is if i assigned these vlans to VRF created on 6509, will fwsm understand this?
I can do this conf on the switch for fwsm - firewall vlan-group 50 55-57 firewall module 8 vlan-group 50 but my SVI have to be in vrf for mpls forwarding. Does FWSM support this kind of vrf functionality? Regards Vikas Sharma On 11/16/07, Fred Reimer <[EMAIL PROTECTED]> wrote: > > Yes, it works fine. You would need to configure the option on > the SUP to allow multiple SVI's to be configured when they are > assigned/trunked to the firewall. See here: > > http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuratio > n/guide/switch_f.html > > > Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS > Senior Network Engineer > Coleman Technologies, Inc. > 954-298-1697 > > > > > > -----Original Message----- > > From: Vikas Sharma [mailto:[EMAIL PROTECTED] > > Sent: Thursday, November 15, 2007 6:20 AM > > To: Fred Reimer; [email protected]; Oliver Boehmer > > (oboehmer) > > Subject: Re: [c-nsp] traffic flow in 6500 switch with FWSM > > and MPLS VPN > > > > Hi, > > > > on the same line i have few more doubts. pls help me to > > solve this. > > > > I have 5 vlans namely data, voice , video and CCTV. Packet > > coming out of access switch will go to SVI and then come to > > FWSM as firewall-group has been configured. Now I want to > > integrate this LAN to my MPLS cloud. I have created two vrf > > (one for voice/data and video) and another for CCTV and > > importing and exporting to all remote sites. > > My question is how does FWSM behave when default gateway is > > on MSFC svi (i have created dot1 q interfaces on svi and > > assign vrf forwarding to respective interfaces). Since on > > svi i have configured vrf forwarding, will FWSM understand > > the firewall-group in this case? > > > > any help is greatly appreciated.... > > > > Regards > > Vikas Sharma > > > > On 11/12/07, Vikas Sharma <[EMAIL PROTECTED]> wrote: > > > > Hi, > > > > Can I configure FWSM as a default gateway for my > > internal vlans (similar to HSRP configuration on MSFC for > > vlans)? i.e inside packet will first hit fwsm then MSFC !!! > > > > If u have some doc on this pls share if possible.. > > > > Regards > > > > Vikas Sharma > > > > > > > > On Nov 7, 2007 7:00 PM, Fred Reimer > > <[EMAIL PROTECTED]> wrote: > > > > > > There are many ways that you can configure the > > 6500 with a FWSM > > and IDSM. It depends on what you want to do > > with it. You can > > place the MSFC (routing entity) inside or > > outside of the FWSM. I > > prefer inside unless there is a really good > > reason to have it > > outside (such as routing sessions to providers, > > etc) as you don't > > need to secure it quite as much as when it is on > > a publically > > accessible address. You could also use VRF on > > the MSFC and have > > one instance on the outside and one on the > > inside (or a bunch of > > instances and one on each DMZ interface of the > > FWSM also). For > > the IDSM you also have an option of in-line mode > > or not. You > > want in-line mode if you want IPS functionality, > > and promiscuous > > mode if you want IDS functionality. Again, you > > can place the > > IDSM inside or outside the FWSM, but it really > > makes sense to > > drop malicious traffic before it even reaches > > your FW. Perhaps > > have it look like Internet -- IDSM -- MSFC -- > > FWSM -- MSFC - > > inside networks. You really need to talk to, or > > hire, a security > > specialist. > > > > Fred Reimer, CISSP, CCNP > > Senior Network Engineer > > Coleman Technologies, Inc. > > 954-298-1697 > > > > > > > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto: [EMAIL PROTECTED] > > <mailto:[EMAIL PROTECTED]> ] On Behalf Of > > Vikas > > Sharma > > Sent: Wednesday, November 07, 2007 3:14 AM > > To: [email protected]; Oliver Boehmer > > (oboehmer) > > Subject: [c-nsp] traffic flow in 6500 switch > > with FWSM and IDSM > > > > Hi, > > > > I have FWSM and IDSN-2 on 6500 switch. Since I > > am not a security > > guy I am > > not able to visualize how traffic flow will take > > place in this > > situation. My > > requirement is to secure internal traffic from > > external / DMZ > > traffic and > > inspect malicious traffic. Can someone give me > > the logical > > picture how > > packet will flow inside 6500 switch? whether it > > will first go to > > FWSM then > > to MSFC or first to MSFC then firewall? I have > > vlan (SVIs) > > created on msfc > > and these ips are default gateway for my > > internal traffic. > > > > Any help is appreciated... > > > > Regards > > Vikas Sharma > > > > _______________________________________________ > > cisco-nsp mailing list cisco- > > [EMAIL PROTECTED] > > https://puck.nether.net/mailman/listinfo/cisco- > > nsp <https://puck.nether.net/mailman/listinfo/cisco-nsp> > > archive at > > http://puck.nether.net/pipermail/cisco-nsp/ > > > > > > > > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
