Is the number assigned for "firewall-group" on 6509 significant?

[jnorth]

Is there any significance to the parameter "firewall-group" in the command

firewall vlan-group <firewall-group> <vlan-id>…<vlan-id>?

In other words is the series of commands

firewall switch 1 module 3 vlan-group 1,2

firewall vlan-group 1 100,101,102

firewall vlan-group 2 200,201,202

exactly equivalent to

firewall switch 1 module 3 vlan-group 3

firewall vlan-group 3 100,101,102,200,201,202

or

firewall switch 1 module 3 vlan-group 1,2,3

firewall vlan-group 1 100,200

firewall vlan-group 2 101,201

firewall vlan-group 3 102,202

All three of these options associate the same set of  vlans to the FWSM but using different groupings. As far as I can tell, these groupings have no functional significance either on the switch side or the FWSM side. These are simply three different ways of specifying exactly the same thing? Am I correct?

[ajay chauhan]

Hi,

Cisco says-

you can assign all the VLANs to one group, or you can create an inside group and an outside group, or you can create a group for each customer.

even though there isn't a practical reason to do so.

Thanks

Ajay

[jnorth]

Thanks. So it is a completely meaningless construct. I wonder why the CLI is not simply something like

firewall switch 1 module 3 vlan 100,101,102

firewall switch 1 module 3 vlan 200,201,202