firewall multiple-vlan-interfaces

irelandsky · ‎06-08-2004

Hi all,

what is the function of "firewall multiple-vlan-interfaces" command??

I need to use it if i would like to associate multiple vlan to FWSM or not?

Another question: When i should configure multiple firewall vlan-group? If i've only one group with multiple vlans associated with it, there are security risk or not??

Thanks

Marco

scoclayton · ‎06-09-2004

Meaning of "firewall multiple-vlan-interfaces" command - by default, you are only allowed one Switch Virtual Interface (SVI) for the VLAN's that are associated with the FWSM. That is, if you have 4 VLAN's tied to the FWSM, only one of them is allowed to have an interface address on the switch's MSFC (such as "interface VLAN 100"). If you have a need for more interfaces on the MSFC for the VLAN's tied to the FWSM, then you can use the above command. But, be careful with this as your packets will be routed through the MSFC rather than the FWSM unless you employ some routing rules on the MSFC.

You do not need this command in order to associate multiple VLAN's to a FWSM.

And finally, there is no requirement to configure multiple "firewall vlan-group" commands on your switch. You can add multiple VLAN's to one statement.

Hope this helps.

Scott

pokwan · ‎06-09-2004

Hi Scott,

Can you please give us an example configuration of the FWSM firewall multiple-vlan-interfaces and the MSFC? We have ordered the Catalyst 6500 with the FWSMs and will be configuring it once we received them. We are looking for notes and examples to understand it better to migrate from the PIX525s to FWSMs.

TIA.

PF

scoclayton · ‎06-10-2004

Hi,

I am afriad I do not have an example that shows the use the "firewall multiple-vlan-interface" command. In most "normal" cases, you will not need this command. A mjority of the designs I have seen have an SVI on the outside interface. With this design, you have a default route on the FWSM that points outbound to your L3 interface on the MSFC where your routing occurs. All other interfaces directly connect via L2 to the hosts on that segment. Take a look at this FAQ and let me know if there is anything I can do to clear up the confusion.

http://www.cisco.com/en/US/products/hw/modules/ps2706/products_qanda_item09186a00801e9e26.shtml#q7

Scott

pokwan · ‎06-14-2004

Scott,

Thanks very much for the link. I will look into it.

PF