Re: [fw-wiz] Problem with Cisco Firewall Service Module running in transparent mode

From: Brian Ford (brford_at_cisco.com)
Date: 08/17/04

  • Next message: Patrick M. Hausen: "[fw-wiz] VPN Client <> PIX 515 with certificates (long!)" 
    To: firewall-wizards@honor.icsalabs.com
Date: Tue, 17 Aug 2004 16:57:47 -0400

    Greg,

    If you check the documentation you'll find that you cannot have both
    transparent (L2) and virtual contexts configured on one FWSM blade in
    v2.2. This will be in a future release.

    Liberty for All,

    Brian

    At 12:00 PM 8/17/2004 -0400, firewall-wizards-request@honor.icsalabs.com wrote:
    >Message: 2
    >Date: Fri, 13 Aug 2004 07:39:08 -0700
    >From: greg padden <paddeng@biostat.wisc.edu>
    >To: firewall-wizards@honor.icsalabs.com
    >Subject: [fw-wiz] Problem with Cisco Firewall Service Module running in
    >transparent
    > mode
    >
    >I have attempting to get a Cisco Firewall Service Module (FWSM) running
    >software version 2.2(1) in transparent mode and multiple context mode.
    >
    >Here is the problem that I am running into:
    >
    >I have a bunch of vlans already routing on the MSFC2 blade, I want to
    >move each of these vlans behind their own "virtual" firewall (what cisco
    >calls a context). So, I first remove this vlan interface from the MSFC2
    >router, then I assign this vlan to the firewall module, assign a new
    >vlan to the firewall module which will become the new outside vlan, then
    >I session into the firewall module and allocate these two vlans to the
    >new context, I then go into the context and define the firewall rules.
    >Go back to the MSFC2 router and define the new "outside" vlan inteface
    >on the router.
    >
    >After I have done this, "some" hosts on the inside vlan cannot connect
    >to "some" places on the Internet (or other places on the outside of the
    >FWSM). If I take a test pc and give it the same ip address of the
    >troubled machine I can confirm that they cannot ping, http, or IMAP to
    >some hosts, but if I take a different ip address on the same LAN I can
    >sucessfully connect to the same outside host (the firewall rules for
    >testing are permit ip any any outbound and inbound, so it is NOT the
    >firewall rules).
    >
    >I have troubleshot this with Cisco about 3 times now and they cannot
    >figure it out. After a reboot of the entire Catalyst 6500 everything
    >works fine!!!
    >
    >So here is my complete setup: Catalyst 6509 with dual supII's with duel
    >MSFC2 routers configured in SRM mode, the Cat is running hybrid IOS 7.6.7.
    >
    >Has anybody else had trouble migrating VLANS from the MSFC2 to a virtual
    >transparent firewall on the FWSM? Or seen this behavior?

    Brian Ford
    Consulting Engineer, Security & Integrity Specialist
    Office of Strategic Technology Planning
    Cisco Systems Inc.
    http://www.cisco.com/go/safe/

    The opinions expressed in this message are those of the author and not
    necessarily those of Cisco Systems, Inc..

    This email address is transmitted from San Jose, California, U.S.A..

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Patrick M. Hausen: "[fw-wiz] VPN Client <> PIX 515 with certificates (long!)"

    Relevant Pages

    • Re: [fw-wiz] Problem with Cisco Firewall Service Module running in transparent mode
      ... according to the Cisco document in Example 5: ... >> I have attempting to get a Cisco Firewall Service Module running ... >> software version 2.2in transparent mode and multiple context mode. ... I first remove this vlan interface from the MSFC2 ...
      (Firewall-Wizards)
    • [fw-wiz] Problem with Cisco Firewall Service Module running in transparent mode
      ... I have attempting to get a Cisco Firewall Service Module running ... software version 2.2in transparent mode and multiple context mode. ... I first remove this vlan interface from the MSFC2 ...
      (Firewall-Wizards)
    • Re: FWSM in front of MSFC
      ... would like to put the MSFC behind the firewall, ... Just create a vlan to be your "outside" interface on the fwsm, then pick a physical interface and configure it as an access port to that vlan. ...
      (comp.dcom.sys.cisco)
    • Re: FWSM in front of MSFC
      ... would like to put the MSFC behind the firewall, ... phyical interfaces on the switch to act as the outside interface on ... Just create a vlan to be your "outside" interface on the fwsm, ... physical interface and configure it as an access port to that vlan. ...
      (comp.dcom.sys.cisco)
    • FINAL SUMMARY: technical routing question on Solaris 10
      ... If you recall, we have a network with 4 VLANs. ... When I used snoop -v to show me layer 2 information, the destination MAC was the firewall/gateway in question, so the packets were happily leaving my machine after all and arriving at the firewall. ... We had a context configured in preparation for having a DS3 link from our office to our data center for management. ...
      (SunManagers)