- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-29-2008 09:29 AM - edited 03-11-2019 05:10 AM
I have two FWSM's, one each in redundantly connected 6500's. The FWSM's are in multi-context routed mode, and active/active failover.
I have 3 contexts, Admin, students, labs. Each context shares interface vlan925 as the connection to the core for routing. The problem I have is that contexts students and labs each have 20+ interfaces I'm treating as "outside" interfaces, but I want to be able to relay DHCP requests to DHCP servers on the inside which is interface vlan925(the shared interface). This is not allowed because it's a shared interface. I cannot use the firewall as the DHCP server according to other requirements. How can I pass DHCP requests?
I had originally thought to give each context it's own SVI for the inside interface to allow routing to the core, but that doesn't seem to be allowed either.
Core1(config)#firewall vlan-group 1 900,925
Found svi for vlan 900
Found svi for vlan 925
No more than one svi is allowed, command rejected.
Solved! Go to Solution.
- Labels:
-
NGFW Firewalls
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-29-2008 09:50 AM
Hi Paul
By default the FWSM will only allow on vlan with an SVI ie. L3 vlan interface, to be allocated to the firewall module. This is a precautionary measure because if you have multiple vlans that have SVI's on the MSFC you could, if you are not careful route "around" the FWSM from one vlan to another thus defeating the purpose of the FWSM.
However if you enter this command on the 6500 switch
6500(config)# firewall multiple-vlan-interfaces
this will then allow you to assign more than one SVI. As ling as you are careful with your vlan layout it won't be a problem.
HTH
Jon
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-29-2008 09:50 AM
Hi Paul
By default the FWSM will only allow on vlan with an SVI ie. L3 vlan interface, to be allocated to the firewall module. This is a precautionary measure because if you have multiple vlans that have SVI's on the MSFC you could, if you are not careful route "around" the FWSM from one vlan to another thus defeating the purpose of the FWSM.
However if you enter this command on the 6500 switch
6500(config)# firewall multiple-vlan-interfaces
this will then allow you to assign more than one SVI. As ling as you are careful with your vlan layout it won't be a problem.
HTH
Jon
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-29-2008 11:34 AM
Thanks, I think this will fix my problem.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-01-2008 12:43 PM
I believe you will still have a problem relaying DHCP from the 20+ VLAN onto the SVI.
I had hit this problem before. Instead you need to split all the routes back to the core router into seperate Border Vlans.
Hope this help.
Regards
John
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-01-2008 01:15 PM
What I should have said was, I assume you are using the Firewall to perform DHCP forwarding?
John
