topic Re: FWSM Communication Issue in Network Security

FWSM Communication Issue

DSPVGAdmin — Mon, 11 Mar 2019 20:19:52 GMT

I have a Cisco 6500 running FWSM version 3.1(10)

Have muliple contexts

ACL's are configured on 2 contexts to allow single hosts to communicate over TCP 7780 (HTTP)

No Communication or Denys or Hits on ACL's

Reseting the VLAN on source Context temp fixes the problem (5mins Max)

Any Idea's ?

Thanks

Re: FWSM Communication Issue

Anu M Chacko — Tue, 12 Apr 2011 11:42:41 GMT

Hi Simon,

Do you have relevant static NAT command for the hosts? When the FWSM exists in the multiple context mode, the traffic is sent to a context depending on 3 criteria: unique interface, unique MAC address or unique NAT translation. If your interfaces are being shared, then a unique translation is needed for the traffic to be forwarded to the correct context.

Regards,

Anu.

P.S.: Please mark the question answered, if it has been resolved. Do rate helpful posts. Thanks.

Re: FWSM Communication Issue

DSPVGAdmin — Tue, 12 Apr 2011 11:45:31 GMT

Would this be the case if I was not running NAT control and both contexts are the same security level.

I never see this issue until a reload of the Cisco 6500 last week.

Thanks

Re: FWSM Communication Issue

Anu M Chacko — Tue, 12 Apr 2011 13:28:50 GMT

Hi Simon,

If everything was working fine before the reload, then maybe some configuration was not saved before it reloaded. Was all that configuration saved before the reload? What are the syslogs you see on the FWSM now, when you try to send the traffic through it?

Regards,

Anu.

Re: FWSM Communication Issue

DSPVGAdmin — Tue, 12 Apr 2011 13:33:18 GMT

Anu,

Yes as 100% I can be the config are the same, we are also get no output in syslogs, no connections built. The statis nat on the source context is

(outsdie,inside) x.x.79.x x.x.79.x 255.255.255.248 - so it is for the whole subnet - the incoming context does not have the statis nat applied

Simon

Re: FWSM Communication Issue

Anu M Chacko — Tue, 12 Apr 2011 14:00:43 GMT

Simon,

Did you take captures on the outside interface? Do you see packets coming into the firewall? Can you put in a specific static NAT command for the destination IP address and test?

Thanks,

Anu.

Re: FWSM Communication Issue

DSPVGAdmin — Tue, 12 Apr 2011 14:40:36 GMT

A Capture on the outside interface (Source Context) shows a SYN being sent but nothing else. Also no hits on the ACL (Outside) so I do not think it is even getting to the Destination Context (inside)

Re: FWSM Communication Issue

Anu M Chacko — Tue, 12 Apr 2011 16:09:49 GMT

Simon,

That is because after the FWSM receives the SYN packet from the sender on the outside, it does not know to which context it has to send it to. Put in the following and test if it works.

static(inside,outside)

Thanks,

Anu.