FWSM strange Issue - not passing traffic through firewall

[pemasirid]

Hi,

We have 2 FWSM modules in each 6500 switches. 1st module is having 04 firewall vlan groups with 18 vlan interfaces in a single context firewall. All are working fine with no issues. Recently we create one more vlan on MFSC and add into the same firewall module. However newly created vlan inside the FW is not able to communicate with outside and also outside users not able to reach newly created subnet. But within the firewall zones (other interfaces) it can communicate. Once we did packet capture we noticed that its hitting firewall outside interface only and when we ping we got TTL expired error. we have default routes to outside and there's no any route inside as new segment is within the firewall (no any hop).

Appreciate if some one can give any hint on this. I guess there's no limitation on number of vlans that we can assign on one firewall eventhough there is a limitation for number of vlan-group which is 16 max (but we are within that limit).

thanks in advance..

[golly_wog · Accepted solution]

Hey

Sounds like you have a routing issue (as you mentioned the TTL expires)

Can you give us a show ip route from the MSFC and a show route from the FWSM please? (even better wouyld be a full show run from the fwsm)

thanks

[pemasirid]

Hi,

Actually the issue was dissapered after remoing the vlan from the firewall group and re-applying the configuration. I'm still not able to find the root cause, however I'm suspecting a bug since the running code is 3.1.

Has anybody come across such issue or found any bug related on this..?

Regards,