Problems Connecting Multiple FWSM Contexts Via a shared Vlan

[iwearing]

Hi,

We have a customer who is migrating all Firewalls onto a FWSM. There is a requirement to daisy chain some of the FW Contexts . The Outside of one context_A connects to the inside of another context_B via a shared Vlan 200. Please note that the only interfaces on the shared vlan are the Context_A outside Vlan and Context_B inside Vlan. It is not possible to pass traffic through both Firewalls when the contexts are connected via the shared vlan 200. However If Context_A is removed from Vlan 200 Context_B will pass taffic sourced from Vlan 200. I can confirm that static routing on the Firewall Contexts is correct.

Any ideas would be appreciated.

[didyap]

You cannot initiate connections from a shared interface when you use NAT exemption for the destination address. The classifier only looks at static statements where the global interface matches the source interface of the packet. Because NAT exemption does not identify a global interface, the classifier does not consider those NAT statements for classification purposes.

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/mod_icn/fwsm/fwsm_2_2/fwsm_cfg/context.htm#wp1036615

[nisse]

Hi,

If you need to daisy-chain, this topology should work (at least according to the test I have done):

Context_A outside interface (sec level 0) connects to Context_B outside interface (sec level 0) instead. By this you can create static entrys in both directions to allow traffic. Static commands are a requirement with shared vlans.

[j.docio]

Hi Nisse,

on the topology that you are describing, will work static NAT of a entire network? or is required to make static NAT host by host?.

I'm reading the configuration guide and I can't well understand it.

Thank you very much

Juan.

[j.docio]

Finally I tried it on our lab.

It works fine, but we need a static entry for every network.

I attach a topology diagram and the configs of the context.

Hope this help to any that need info about this topic.

The config of the system is:

*********

:

PIX Version 7.0(1)

!

interface Ethernet0

!

interface Ethernet0.1

shutdown

no vlan

!

interface Ethernet0.10

vlan 10

!

!

interface Ethernet1

!

interface Ethernet2

!

interface Ethernet3

shutdown

!

enable password xxx

hostname pixfirewall

ftp mode passive

pager lines 24

no failover

asdm image flash:/asdm-501.bin

no asdm history enable

arp timeout 14400

console timeout 0

admin-context admin

context admin

allocate-interface Ethernet0.10 outside visible

allocate-interface Ethernet1 inside visible

config-url flash:/admin.cfg

!

context cpd

allocate-interface Ethernet0.10 outside visible

allocate-interface Ethernet2 inside visible

config-url flash:/cpd.cfg

!

Cryptochecksum:xxx

: end

*********

[tanvictor]

This is great info. Thanks for testing it out. I was looking for an answer to this too.

Would it be possible for you to try the same config, but daisy chaining admin_context outside to cpd_context inside? If this works, it'll solve my DMZ problem using 2 contexts.