FWSM - L3 Interface Security Levels

[packetzen]

We have about 15 L3 interfaces on the FWSM, all with security level 50

(except for the Outside interface which is 0)  We have a new vlan that we want to

segragate from the other vlan's on the fwsm.  We currently have the 'enable traffic

between interfaces with the same security level' checked.

When I select my new vlan to change it to a higher security level, I get the

following message.

"Changing the security level of an interface may cause your FWSM configuration to become

invalid, casuing the fwsm to drop legal traffic or allow illegal traffic.  do you wish to

proced. "

I am concerned about making this change becuase the message states that my configuration

may become invalid.  Is this true?  Is this a standard config?

Thanks!

[Jennifer Halim]

Yes, basically it means that you will have to reconfigure the access between this interface and all other interfaces.

Traffic from low to high security level will require either static NAT or NAT 0 with ACL. Traffic from high to low can be configured with any translation.

You just have to redesign your access and make sure that you don't break the initiate access depending on what you are trying to achieve.