FWSM design and configuration assistance

[rramlal]

Hi

We have a customer that has purchased a 6509 with two fwsm modules.

The customer would like to locked down traffic between all of the vlans. There exists edge firewalls for the dmz so the fwsm is just for tightening the internal networks.

There consists of approximately 10 vlans.

Can you advise what mode should be used. i am green in the field of security and have been reading the fwsm config guide but i am getting confused. Please help.

I need to visualise how both scenarios will work and which will be best, this is a finacial institution with a large number of sites connected to this core network.

[Panos Kampanakis]

You can use routed mode firewall with 10 vlans. The firewall rules will be giving access between the vlans.

If you want to conceptually segment vlans you can put some vlans in one context and other in other context (multi-context mode). That way you have a virtual firewall "firewalling" different organizational parts of the institution.

I would suggest looking into the FWSM config guide for concepts like mutli-context and routed mode.

I hope it helps.

PK