Setup: We host over 1200 websites.  There are redundant Cisco 6509 (with FWSM) used to create the DMZs.  Port 80 and 443 are allowed only from the outside (Internet) to the Blue Coat Reverse Proxies (DMZ1).  Then the port is changed and the Blue Coat (DMZ1) and is forwarded to the the IIS Web Server (DMZ2).  There is no direct access to the Web Servers or their content.  We also block all outbound traffic from all DMZs. Scenario: The IIS Admin acidently turned on folder browsing on the Web Server with live sites.  This allowed Google to crawl the directory and cache the contents publicly. Question: Is there a way I can still all the http and https request but block Web Crawls? ... View more

It looks like both my HSRP Interfaces (VLAN 600 & 700) cycle through standby --> active ---> speak continuously on one of the two switches.  What can be causing this? *May  4 06:41:24.883: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Speak -> Standby *May  4 06:41:33.671: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Standby -> Active *May  4 06:41:33.671: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Active -> Speak *May  4 06:41:34.251: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Speak -> Standby *May  4 06:41:47.691: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Standby -> Active *May  4 06:41:47.703: %HSRP-5-STATECHANGE: Vlan700 Grp 0 state Active -> Speak ... View more

Equipment: HP Blade Enclosure C7000 HP GbE2c Ethernet Blade Switches (x2) [We will call these switches 1 & 2] Cisco 6509 (x2) Core Switches [We will call these switches A & B] Current Setup: The servers in the HP Enclosure have dual NICs that connect to each HP GbE2c Ethernet switch There is a dual internal cross over link between the two HP GbE2c Ethernet switches (disabled by default) Each HP Switch has four external uplink ports that you can run LACP to create a trunk port. I have created a 4x1Gb LACP trunk between HP Switch 1 and Cisco 6509 A I have created a 4x1Gb LACP trunk between HP Switch 2 and Cisco 6509 B Cisco 6509 switch A has two 10Gb ports in Port-Channel 1 (trunk) connecting to Cisco 6509 switch B I am running all Layer 3 routing on the Cisco switches using HSRP Question: Should I enable the link between the two HP GbE2c switches?  I don't believe you can setup these ports as trunks (i.e. LACP).  Would this create a Layer 2 loop? Thanks, Damien ... View more

I have a question about the picture attached.  The diagram shows each Cisco 4948 connecting to each Cisco 6506.  Since there are only two 10GB ports, there are no ports available to connect the Cisco 4948 (trunk) to each other.  I currently have one 10GB port on each Cisco 4948 (OSPF) connected to each Cisco 6506 (core).  I then have the second 10GB port on each Cisco 4948 connected to each other via a trunk link.  Is there performance advantages of setting up the redundant paths one way or the other? Thanks, ... View more

I have a question about how I should setup NAT on our 6509's with relation to the FWSM and MSFC. Is it better to NAT at the MSFC or FWSM?  We do plan on having at least 1 DMZ in addition to the "inside" and "outside" networks if that helps. If we put the NAT on the FWSM, then option 1 would have our FWSM connected directly to the ISP 2811 routers.  We could also use Option 2 where the MSFC is connected directly to the ISP 2811 routers.  This would require us to extend the public network down to the FWSM.  That is why I have the virtual connection between the MSFC and FWSM in option 2 as "Network Unknown." If we put NAT on the MSFC, then we could use option 2 where the MSFC is connected directly to the ISP 2811 routers.  This would allow us to use a private network for the virtual link between the MSFC and FWSM. I have read somewhere that, for security reasons, it is best to place the MSFC between the Internet and the FWSM.  I am looking for any help or suggestions. Thanks, ... View more

Our ISP has two routers onsite.  The primary router has a 40MB connection to the Internet and the secondary router as a 20MB connection to the Internet.  I am configuring our two 6509's with a FWSM in each so that the MSFC is inside and the FW is facing the ISP routers. Question: Can I setup HSRP between the FW and the ISP routers? I have attached a diagram showing the connection between the ISP and the 6509. Thanks ... View more

I have attached a drawing of our network.  We have two 6509's connected to two Cisco 2811 (onsite) that the ISP owns. I am trying to get one side up and running before I worry about redundancy and so forth.  For this reason I have set all the HSRP priorities to 110 on the left 6509.  I have HSRP running between the ISP routers and VLAN 101 of the 6509's.  This works as I can ping yahoo and google just fine from the 6509 switch.  I can't get from my laptop connected to VLAN 23 to the internet.  It doesn't even attempt to NAT as there are no translations.  I have public address assigned by my ISP configured between the ISP routers and my 6509 on VLAN 101.  I then have the public address assigned to VLAN 100.  I configured VLAN 100 on the switch and VLAN 100 on the FWSM with the IP address in the drawing.  I have my NAT statements and route in my FWSM according to the drawing as well.  On the switch, I have a default route to X.X.12.19 which is the VIP between the ISP routers.  I can reach anything on the inside of my network, including the old network addresses from VLAN 23. 1. Is it best to do NAT at the FWSM or should I do it on the MSFC connected to the ISP routers? 2. If I have to configur NAT at the FWSM, does this requires me to extend the public network down to the FWSM? 3. I'll take any examples you may have as I am stuck. Thanks in advance. ... View more

We have a 6509-E with a FWSM.  I am looking for some help on how to connect our transparent Proxy appliance so that it is inline with the switch and firewall.  Below is the logical path that I would like the data to take.  Because this is a transparent device, it will not have any IP's associated the either interface.  I have used this configuration with an ASA 5550, Proxy, 3750v2.  It was easy to connect because these are physically seperate devices.  I am having a hard time figuring out the cofiguration and connections since the FW and Switch are physically one device. Users --> GW --> Proxy --> FW --> ISP Thanks, ... View more