Hi guys,
Hi have the follwing scenario:
two 6509 chassis with VSS configuration.
One of those chassis have one FWSM installed and the configuration is like this:
Switch:
firewall multiple-vlan-interfaces
firewall switch 1 module 3 vlan-group 1
firewall vlan-group 1 3-5,7,8,10,200
interface Vlan200
ip address 10.50.50.1 255.255.255.252
end
ip route 172.20.80.0 255.255.255.0 10.50.50.2
FSWM:
interface Vlan10
nameif ADMIN
security-level 100
ip address 172.20.80.1 255.255.255.0
!
interface Vlan200
description Lig. CORE
nameif FWSM_INSIDE
security-level 100
ip address 10.50.50.2 255.255.255.252
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list FWSM_INSIDE extended permit ip any any
access-list FWSM_INSIDE extended permit icmp any any echo
access-list FWSM_INSIDE extended permit icmp any any echo-reply
access-list FWSM_INSIDE extended permit icmp any any unreachable
access-list FWSM_INSIDE extended permit icmp any any time-exceeded
access-list FWSM_INSIDE extended permit icmp any any log
...
icmp permit any ADMIN
icmp permit any echo ADMIN
icmp permit any echo-reply ADMIN
icmp permit any unreachable ADMIN
icmp permit any time-exceeded ADMIN
icmp permit any FWSM_INSIDE
icmp permit any echo FWSM_INSIDE
icmp permit any echo-reply FWSM_INSIDE
icmp permit any unreachable FWSM_INSIDE
icmp permit any time-exceeded FWSM_INSIDE
...
I am not receiving icmp replays from the fswm interfaces if i try to ping 172.20.80.1 from 10.50.50.2.
I do not see any debuging info in the logs...
I successfully ping 10.50.50.2 from the inside networks int the cat6500, but int the network 172.20.80.0, can not ping 10.50.50.2.
can you help please?
best regards,
NC
