PVLAN on FWSM interface on 6500

[rhholmes]

Hi,

Is it possible to apply a PVLAN configuration on a 6500 and have the interface on the FWSM configured as a promiscuous interface.

I found an old thread that said it couldn't be done, but that it might in the future.

The etherchannel interface between the switch and the FWSM uses PAgP and the PVLAN document states that PVLANs are no compatible with PAgP or LACP. (The document referred to is 6500 IOS config guide for release 12.2SXF.)

Can anyone confirm if the latest hardware/software versions can now support this configuration?

Thanks,

Rob

[gpulos]

Per cco docs:

"PVLAN support on Firewall Services Module (FWSM) begins in software version 3.1. If you run a software version earlier than 3.1, the only possible workaround is to connect the promiscuous port of the PVLAN using the crossover cable to a regular access port. Then, make a firewall for the VLAN of that access port."

Please see the following link for the PVLAN Cat Switch Support Matrix:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a0080094830.shtml

Also in the FWSM FAQ:

http://www.cisco.com/en/US/products/hw/modules/ps2706/products_qanda_item09186a00801e9e26.shtml#q32b

[rhholmes]

Thank you. That got it working. I'm surprised that there is no configuration required on the sup card or FWSM to get this working. Meaning I didn't have to assign it as a promiscuous port.

Are there any parameters to configure at the FWSM? What if I didn't want the FWSM interface to be promiscuous, or at least control which community VLANs it could access. Is there a way to control this?

Thanks again.