topic Re: FWSM Multiple context in Network Security

FWSM Multiple context

cisco_lite — Mon, 11 Mar 2019 14:42:07 GMT

Hi,

Is there any FWSM multiple context configuration example with 'shared ingress Vlan interface'.

Thanks.

Re: FWSM Multiple context

Jon Marshall — Mon, 26 Jan 2009 17:39:11 GMT

When you say shared ingress vlan do you mean that each context shares a vlan for it's outside interfaces ie. each context uses an IP address from the same subnet on it's outside interface ?

Also is it safe to assume multiple context routed mode ?

Finally, which version of FWSM software ?

Jon

Re: FWSM Multiple context

cisco_lite — Mon, 26 Jan 2009 17:45:45 GMT

"When you say shared ingress vlan do you mean that each context shares a vlan for it's outside interfaces ie. each context uses an IP address from the same subnet on it's outside interface ? "

Yes, that is what I meant.

The multiple context shall be in routed mode.

FWSM version 3.2(2)

Thanks.

Re: FWSM Multiple context

Jon Marshall — Mon, 26 Jan 2009 17:51:18 GMT

Here you go -

http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/exampl_f.html#wp1029314

Jon

Re: FWSM Multiple context

cisco_lite — Mon, 26 Jan 2009 18:03:08 GMT

Thanks Jon.

Couple more questions

1. Is NAT a condition to use multiple context with shared outside interface

2. Can IDSM be deployed to FWSM in multiple context. I believe If I failover single FWSM context to redundant Cat6500 chassis, IDSM will not work because IDSM can be active against one physical FWSM only.

Thanks.

Re: FWSM Multiple context

Jon Marshall — Mon, 26 Jan 2009 18:22:14 GMT

No problem.

1) That's a very good question. When you share a vlan between contexts then the FWSM classifier comes into play. You need to have a read of this section. Sharing the same vlan for outside contexts is the most common approach so it is less problematic -

http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/contxt_f.html#wp1124236

If you have any more questions on this please come back.

2) Unfortunately can't really help you on this as i have no real experience with the IDSM. I have used CSM-S modules (load-balancers) in conjunction with the FWSM's and they work in failover mode but i wouldn't want to say if this is possible with the IDSM.

Jon

Re: FWSM Multiple context

cisco_lite — Mon, 26 Jan 2009 18:35:22 GMT

Jon,

In my case all the NAT'ing is done on perimeter firewall and not FWSM. Traffic from firewall is routed to MSFC and then FWSM. So there is a single outside interface on FWSM, where the destination IP is already NAT'ed and should belong to one of the contexts (unique IP address). My understanding is that classifier would 'not' be required in the above scenario. Please advise.

Topology:

ASA->MSFC->FWSM->ACE

Re: FWSM Multiple context

Jon Marshall — Mon, 26 Jan 2009 18:44:14 GMT

Okay, i'm a little confused :-).

You say there is a single outside interface on FWSM but we were talking about multiple contexts using the same vlan for outside interfaces ?

Assuming you are talking about a single context then note this from the link i sent -

"Because the classifier relies on active NAT sessions to classify the destination addresses to a context, the classifier is limited by how you can configure NAT. If you do not want to perform NAT, you must use unique interfaces."

So you need NAT but all this means is you need to setup static translations ie. you don't need to actually change the IP address eg.

static (inside,outside) 192.168.5.0 192.168.5.0 netmask 255.255.255.0

Does this make sense or have i misunderstood your topology ?

Jon

Re: FWSM Multiple context

cisco_lite — Mon, 26 Jan 2009 19:49:32 GMT

Ok. I meant single shared vlan by outside across multiple contexts.

So I understand NAT to be a condition (even though to same IP) for multiple contexts to work in the given topology and requirement.

Jon, if you don't mind could you please provide your valuable inputs on the below post in 'Lan,Switching & Routing'

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=LAN%2C%20Switching%20and%20Routing&topicID=.ee71a04&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc2d744

Thanks.