Restricting Inter-VLAN Routing on 6509-E

[aaron.conaway]

I have a set of 6509s with FWSMs in one. The network design requires multiple VLANs in front of, behind, and in a DMZ of the FWSM. How do I guarantee that traffic goes up through the FWSM as expected instead of being routed via the MSFC directly to the target network?

[wdrootz]

A sample configuration look like this

security ACLs

set security acl ip postacl permit arp

set security acl ip postacl permit ip any any

[mbernhardt]

The vlans that need to be FWSM-protected should be configured at Layer 3 on the FWSM only, not on the MSFC. Assign them to the FWSM in the switch configuration and it should take care of itself. Make sure that the MSFC has routes to the networks behind the FWSM and vice versa- it's behaving as another router in this configuration.