02-29-2008 09:29 AM - edited 03-11-2019 05:10 AM
I have two FWSM's, one each in redundantly connected 6500's. The FWSM's are in multi-context routed mode, and active/active failover.
I have 3 contexts, Admin, students, labs. Each context shares interface vlan925 as the connection to the core for routing. The problem I have is that contexts students and labs each have 20+ interfaces I'm treating as "outside" interfaces, but I want to be able to relay DHCP requests to DHCP servers on the inside which is interface vlan925(the shared interface). This is not allowed because it's a shared interface. I cannot use the firewall as the DHCP server according to other requirements. How can I pass DHCP requests?
I had originally thought to give each context it's own SVI for the inside interface to allow routing to the core, but that doesn't seem to be allowed either.
Core1(config)#firewall vlan-group 1 900,925
Found svi for vlan 900
Found svi for vlan 925
No more than one svi is allowed, command rejected.
Solved! Go to Solution.
02-29-2008 09:50 AM
Hi Paul
By default the FWSM will only allow on vlan with an SVI ie. L3 vlan interface, to be allocated to the firewall module. This is a precautionary measure because if you have multiple vlans that have SVI's on the MSFC you could, if you are not careful route "around" the FWSM from one vlan to another thus defeating the purpose of the FWSM.
However if you enter this command on the 6500 switch
6500(config)# firewall multiple-vlan-interfaces
this will then allow you to assign more than one SVI. As ling as you are careful with your vlan layout it won't be a problem.
HTH
Jon
02-29-2008 09:50 AM
Hi Paul
By default the FWSM will only allow on vlan with an SVI ie. L3 vlan interface, to be allocated to the firewall module. This is a precautionary measure because if you have multiple vlans that have SVI's on the MSFC you could, if you are not careful route "around" the FWSM from one vlan to another thus defeating the purpose of the FWSM.
However if you enter this command on the 6500 switch
6500(config)# firewall multiple-vlan-interfaces
this will then allow you to assign more than one SVI. As ling as you are careful with your vlan layout it won't be a problem.
HTH
Jon
02-29-2008 11:34 AM
Thanks, I think this will fix my problem.
03-01-2008 12:43 PM
03-01-2008 01:15 PM
What I should have said was, I assume you are using the Firewall to perform DHCP forwarding?
John
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide