topic Re: Is it possible to factory restore FWSM in Network Security

Is it possible to factory restore FWSM

sreekanth sreedharan — Mon, 11 Mar 2019 19:20:15 GMT

Hi,

Is it possible in fwsm to delete the image that has been loaded in the application pratition e.g cf:5, so that FWSM looks like how its came from the store.

Re: Is it possible to factory restore FWSM

Kureli Sankar — Thu, 09 Dec 2010 17:50:55 GMT

NO. You just do a "write erase" and reload without saving to wipe the config.

As far as the code you just have to upload the code that you need via tftp.

-KS

Re: Is it possible to factory restore FWSM

sreekanth sreedharan — Fri, 10 Dec 2010 06:06:48 GMT

Thank you for the swift reply, I had a doubt regarding the same. I have installed 4.0.4 image on cf:4 and cf:5, is there any way to delete what i installed on cf:5.

Re: Is it possible to factory restore FWSM

fadlouni — Fri, 10 Dec 2010 14:26:22 GMT

Hi.

You can't delete the software on a partition. you can only install another one in place of the current one.

Regards,

Fadi.

Re: Is it possible to factory restore FWSM

sreekanth sreedharan — Fri, 10 Dec 2010 15:59:18 GMT

One more doubt. I have implemented VSS with 12.2sxi4a and FWSM 4-1-3. The doubt regarding this is whether the configuration on active FWSM will be replicated on to the standby fwsm on standby chasis. I have not deployed failover between FWSM's and i have done a VSS FWSM integration with standlone FWSM.

Re: Is it possible to factory restore FWSM

Kureli Sankar — Fri, 10 Dec 2010 17:12:56 GMT

Yes. It sure will. That is what failover is all about.

Any command that you add to the active unit's configuration it will get replicated over to the standby unit via the failover vlan.

You can see sample configs here: http://www.cisco.com/en/US/docs/security/fwsm/fwsm41/configuration/guide/exampl_f.html#wp1049436

If this answers your question pls. mark this thread answered.

Thanks,

Kureli

Re: Is it possible to factory restore FWSM

sreekanth sreedharan — Sat, 11 Dec 2010 05:48:14 GMT

Thanks poonguzhali for the reply, But

my doubt is that , i am deploying FWSM in VSS with prescribed

IOS and fwsm software, according to the link : http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/white_paper_c11_513360.html

if i am deploying Fwsm's in standalone mode in vss and publishing the vlan groups for both chasis as below

firewall switch 1 module 5 vlan-group 5

firewall switch 2 module 5 vlan-group 5

whether i could achieve fwsm failover with out giving below mentioned command in fwsm. Please note this is FWSM VSS integration scenerio.

failover lan interface faillink vlan 10

failover link statelink vlan 11

failover lan unit primary

failover preempt 5

failover interface ip faillink 192.168.253.1 255.255.255.252 standby 192.168.253.2

failover interface ip statelink 192.168.253.5 255.255.255.252 standby 192.168.253.6

failover interface-policy 50%

failover replication http

failover

I am thinking in this way: In VSS if i am putting FWSM on the primary 6509 and FWSM on seconday 6509 (using ios :12.2(33)SXI and 4.1.3), The fwsm's will act just like putting 2 FWSM's on a singe 6509 chasis. Please correct if i am wrong

...

Re: Is it possible to factory restore FWSM

Kureli Sankar — Sat, 11 Dec 2010 15:44:59 GMT

Sreekanth,

You do need to configure failover between the two FWSMs if you want to achieve failover.

Otherwise there is no mechanism to sync config between the two FWSMs when config changes on one unit.

-KS

Re: Is it possible to factory restore FWSM

sreekanth sreedharan — Sat, 11 Dec 2010 17:16:28 GMT

Thanks Poonguzhali, It was my confusion which lead to these doubts on VSS-FWSM integration.

Re: Is it possible to factory restore FWSM

sreekanth sreedharan — Sun, 12 Dec 2010 08:10:37 GMT

Hi poonguzhali,

I have one doublt regarding FWSM 4.1 ,We used to copy the access list and other configuration to fwsm using Telnet console to FWSM via session slot command from 6500 Switch, I have seen that when copying more than 5 access-list at a time to any context ,the telnet session as well the connectivity is lost for more that 5 minutes and the switch port on which i connected my laptop is not able ping the Switch SVI. Also the commands i copied are not reflected in the context configuration.I found this in both 4.0 and 4.1. What might be wrong.

Thanks

Sreekanth V.S

Re: Is it possible to factory restore FWSM

Kureli Sankar — Sun, 12 Dec 2010 19:55:23 GMT

Sreekanth,

Next time it would be nice if you would spin up a new thread for each new issue. This one started off with "restore to factory default" then touched on vss stand alone and failover now, you are talking about access-list copy paste and losing connectivity.

Also, pls. consider rating/marking the post answered when your initial query is answered.

Well I believe the ACL optimization is taking some time to complete.

Could you try to take all the acl and put them on a text file and then upload the file via tftp to the disk: and then "copy disk:/acess-list.txt run"?

You you have access-list optimization enabled? If so disable that and try it again.

Look for the command "ACCESS-LIST OPTIMIZATION ENABLED".

Here is the command ref: http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/command/reference/a1.html#wp1622153

-KS

Re: Is it possible to factory restore FWSM

sreekanth sreedharan — Mon, 13 Dec 2010 13:21:16 GMT

Sorry fot that. I will make a new thread for it . Thanks poonguzahli for the help.