1. Home
  2. Cisco Systems
  3. FWSM deployment questions

FWSM deployment questions

Hi friends,

Just wanted to know basically if a requirement is supported in the FWSM or not.

There is a FWSM 3.1 blade on the 6500. The main intention of purchasing it was to protect traffic to and from Server VLAN's. There are totally about 12-13 servers grouped into 2-3 server VLAN's.

What is unique about the customer's requirement is that:

  1. there are servers on the same SUBNET that also need to be protected from each other!!! I am wondering if this is every possible. Moreover, these servers are not connected to the 6500 directly. They are connected to an access switch and the access switch connects to the core. So, the traffic will never pass to the core at all. Is there a possibility that I can physically segment such servers to separate switches and put the FWSM in between them. I heard that there is something called bridging VLAN's? I am not sure about this.

  1. the second unique requirement is that there are vendors who login to the servers remotely to provide remote application support. These vendors should not be able to access other servers just because they have reachability to one server. I am wondering if this kind of protection can be provided at network level? At host level, may be there is a possibility.

I am very sorry if i am asking any dumb questions. But if its possible, i would really appreciate any pointers to further directions in this regard.

Thanks a lot Gautam

Reply to
gautamzone
Loading thread data ...

Greetings,

This may not be what you are loking for, however have you investigated using "port protected"? Basically, lets say you have VLAN 77 on ports

1/1 - 1/5, and ports 1/2 - 1/5 have "port protected" enabled, but port 1/1 does NOT have Port Protected enabled, then port 1/1 can talk to ALL ports in that VLAN, and port 1/2 can ONLY talk to port 1/1. Same for ports 1/3 - 1/5, they can onyl talkt to Port 1/1.

This stops communication between Ports 1/2 - 1/5 at the Layer 2 level, so you need to use Layer 3 to communicate between any Protected port and any other Protected port, but to do this the traffic HAS to go via port 1/1.

For such a small number of servers, surely using separate VLANS would provide what you are looking for?

Cheers......................pk.

Reply to
Peter

Hi Peter,

Thanks a lot for your reply > Greetings,

Reply to
gautamzone

Hi Gautam,

Well you need a promiscuous port somewhere in that PVLAN. It really depends on exactly how you wish to manage the traffic, but basically, you need to - 1. Decide on how you are going to Manage the Layer 3 traffic itself (IE via and ACL or via an external Firewall). 2. Decide which ports need to be Private and which ones Promiscuous.

EG: if you wish to use a Firewall, then just put the Firewall on the Promiscuous port and do everything in there. You may not need to take it to the 6500 if you are going to use a Firewall to handle it.

This document may provide more detail -

formatting link
Cheers.............pk

Reply to
Peter

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.