Cisco Firewall :: 6509 -Creating FWSM Intra-Chassis Redundancy

Oct 27, 2011

Currently we have two inter-chassis FWSM redundancy. I would like to configure them for intra-chassis.
 
Both FWSM's are in slot 7 of 6509 switches and i want to take secondary out from one of the 6509 switch and insert in the slot 3 of primary switch.
 
I addedd the following commands in my primary switch.
 
There were commands already present for FWSM in primary switch
 
firewall multiple-vlan-interfaces
firewall module 7 vlan-group 1
firewall vlan-group 1  2,3,777
 
to create intra-chassis redundancy i addedd the following command also there.
 
firewall module 3 vlan-group 1
 
after adding that, my firewalls worked fine but there was a issue with site loading. People from outside were able to access inside but from inside, we were not able to go outside.
 
do we need to clear arp from both FWSM's ? is there any other precautionary step, which we need to follow while working on it.

View 1 Replies


ADVERTISEMENT

Cisco Switching/Routing :: 6509 - VSS Active Chassis Both FWSM And VSS Failover

Sep 25, 2012

Any have experience on triggered failover on VSS deployment with 1 VS-720-10G-3C in each chassis? I tried using "redundancy force-switchover" but after that the 20G VSL is flapping up & down and cannot be up normally, we got 1 FWSM in each chassis, any configuration need to fit in this kind deployment? BTW, if I shutdown the power source of VSS active chassis, both FWSM & VSS can failover normally.

View 3 Replies View Related

Cisco Firewall :: Can Upgrade FWSM 4.0.3 To 4.0.17 With Chassis IOS

Jul 9, 2012

Can I upgrade FWSM 4.0.3 to 4.0.17  with Chassis IOS s72033-adventerprisek9_wan-mz.122-33.SXH4.bin ?
 
In chassis's slot we have ACE and FWSM slot also. if I will upgrade chassis it will reboot ACE too.I do not want to reload Chassis.

View 2 Replies View Related

Cisco Firewall :: FWSM (in 6509) Is Not Coming Up?

Oct 29, 2012

our FWSM (in 6509) is not coming up, when tried to sesssion up using "Session slot 1 proc 1" command,It is giving error , "Tyring 127.0.0.11 .....connection timed out remote host not responding".
 
In "show mod" command output at Switch in IOS console:  under Card Type Section:  it is showing Model & Serial Number correctly,  Under MAC address sectino: displaying some MAC address But in Online Diag Status, it showing "Unknown" for Module 1.
 
We tried re-seating in other slots, but of no use. Giving same error. Some of other forms are saying it is the issue with 128 Mb CF image problem, FWSM is no more reachable from 6509 IOS console. We even tried using FWSM console (using PC-Conse & LCP Console) but FWSM is not contactable. 

View 1 Replies View Related

Cisco Firewall :: 6509 - FWSM Log Messages

Jul 16, 2011

I think I got a strange behavior on a context of my WS-SVC-FWM-1 (on a Catalyst 6509 running IOS 12.2(18)SXF17a) that is running FWSM Firewall Version 4.1(3). This context sends these log messages every ten minutes:
 
Jul 17 2011 23:31:16: %FWSM-6-302010: 0 in use, 0 most used
Jul 17 2011 23:31:17: %FWSM-6-302010: 2245 in use, 107133 most used
[code]...
 
If I issue the "show conn" three seconds later the log message, the output I got is: FWSM#   sh conn 1041 in use, 107133 most used
 
In another context on the same FWSM the log message sent every ten minutes is just this one:
 
Jul 17 2011 23:31:17: %FWSM-6-302010: 1358 in use, 72503 most used
Jul 17 2011 23:41:22: %FWSM-6-302010: 1590 in use, 72503 most used
 
In this case there is no the log message where the "in use" field and "most used" field are 0 (zero). why does the context send the message with the "in use" field and "most used" field 0 (zero).

View 1 Replies View Related

Cisco Firewall :: 6509 / 2811 - NAT At FWSM

May 17, 2011

I have attached a drawing of our network.  We have two 6509's connected to two Cisco 2811 (onsite) that the ISP owns. I am trying to get one side up and running before I worry about redundancy and so forth.  For this reason I have set all the HSRP priorities to 110 on the left 6509.  I have HSRP running between the ISP routers and V LAN 101 of the 6509's.  This works as I can ping yahoo and Google just fine from the 6509 switch.  I can't get from my laptop connected to V LAN 23 to the internet. 

It doesn't even attempt to NAT as there are no translations.  I have public address assigned by my ISP configured between the ISP routers and my 6509 on V LAN 101.  I then have the public address assigned to V LAN 100.  I configured V LAN 100 on the switch and V LAN 100 on the FWSM with the IP address in the drawing.  I have my NAT statements and route in my FWSM according to the drawing as well.  On the switch, I have a default route to X.X.12.19 which is the VIP between the ISP routers.  I can reach anything on the inside of my network, including the old network addresses from V LAN 23.  
 
1. Is it best to do NAT at the FWSM or should I do it on the MSFC connected to the ISP routers?  
2. If I have to configure NAT at the FWSM, does this requires me to extend the public network down to the FWSM? 
3. I'll take any examples you may have as I am stuck.

View 2 Replies View Related

Cisco Firewall :: 6509 / High Connections On FWSM?

Oct 19, 2011

I am having issues trying to track down what is causing a high number of connection on our FWSM in our core 6509 switch. I recently upgraded my FWSM to 3.1(20) and I'm looking for a tool to be able to find the culprit. When I receive these messages I try to get onto the firewall in time to be able to get information regarding this issue but by the time I do the device recovers. Is there a way to tweat the threshold of the SNMP trap for high connections? Is there any way I can retreive this information via SNMP? Is there are command that will allow me to extract the local IP making the most connections?

View 1 Replies View Related

Cisco Firewall :: 6509 - FWSM With Packets Dropped

Jun 9, 2013

I happen to noticed the FWSM was dropping packets at about 387 packets every 5 minutes. My outside FWSM is WAN facing and has a 1gig link (35% utilized) my inside facing has about 100 downstream switches to the closets. I do not see my 6509's back plane is being over utilized and my understanding of the FWSM show be go for 5 gig so it isn't oversubscribe. Why i am seeing packets dropped?

[Code] ......

View 2 Replies View Related

Cisco Switching/Routing :: 6509 To 6509-E Chassis Upgrade?

Nov 21, 2011

I currently have a couple of 6509 chassis (router/switches) with the following hardware blades:

     x3     48 ports
     x1     NAM
     x2     Sup720
     Running 12.2(18)SXF3
 
I am keeping the four Sup720 modules and have purchased new versions of the others blades including two new 6509-E chassis?Can I take my stand-by Sup720 out of the production machine and insert it into the new chassis?

View 2 Replies View Related

Cisco Switching/Routing :: Upgrade Of 6509 To 6509-E Chassis

Nov 21, 2011

I currently have a couple of 6509 chassis (router/switches) with the following hardware blades:

x3     48 ports
x1     NAM
x2     Sup720

Running 12.2(18)SXF3.I am keeping the four Sup720 modules and have purchased new versions of the others blades including two new 6509-E chassis. Can I take my stand-by Sup720 out of the production machine and insert it into the new chassis?

View 2 Replies View Related

Cisco Firewall :: 6509 FWSM Configuration With Shared Interface

Jul 2, 2011

I have attached a pdf of an example of a FWSM configuration with shared interfaces. Now what I dont get is (please refer to the link) url...Is there any difference between the natting that they have done on page B-4 on Context A.as opposed to configuring a static NAT for processing traffic to correct context nat(inside,outside) 209.165.201.0 10.1.2.0.The other question is on page B-2 (diagram) Context A has a customer A network linked to the inside interface. Is it possible to put a default route towards that "Network 2" cloud and restrict traffic from the 6509 switch towards the context A?

View 5 Replies View Related

Cisco Firewall :: 6509-E / Traffic Coming From GRE Interface And Going Further Through FWSM?

Oct 4, 2011

I have problem with traffic coming from GRE interface and going further through FWSM on the same 6509-E chassis.It's very interesting and confusing. If packets are fragmented, I can go through, however, if I use normal packets (usual ping for example) traffic goes from outside to inside and stops on it's way back.
 
Here is the detailed info:
WS-C6509-E with WS-SUP720-3B
FWSM HW 4.0,  SW 4.1(4) 
 
GRE is done in hardware (source is loopback interface - only one loopback per GRE tunnel).

View 5 Replies View Related

Cisco Firewall :: 6509 / Configure VPN In FWSM (4.0.4) Multiple Context?

Jan 8, 2012

i have 6509+FWSM(4.0.4)  now i wanna use stite to stite  and ez vpn in the fwsm (multiple context) multiple context mode in fwsm support ipsec vpn?

View 2 Replies View Related

Cisco Firewall :: FWSM For 6506 / 6509 Is Supported In VSS Environment?

May 29, 2012

Does the FWSM for a 6506/6509 is supported in a VSS environment?Also, does the FWSM work with the 2T supervisor module? 

View 1 Replies View Related

Cisco Firewall :: 6509 - Management Access To FWSM Using CA Ssl Certificate

Mar 6, 2011

I need to enable Management access to FWSM using CA ssl certificate.
 
FWSM Version 3.2(5) in Cisco 6509 switch.
 
Got to know how to generate, import and export certificate but my query is how to get it applied to the management ip do i need to apply in the management interface.

View 1 Replies View Related

Cisco Firewall :: 6509 - FWSM To ASASM Object Conversion

Nov 4, 2012

We are in the process of migrating to the ASA service modules on both our 6509E switches from our current FWSM. We have used the Cisco conversion tool and applied that to the service module. When viewing the context in ASDM we are unable to view the object names in the right hand pane.
 
On the FWSM I would see the following under Network Objects:
 
Network Objects
- JQ-Test
- JQ-Test2
- JQ-Test3
 
Network Object Group
+ JQ Group
      - JQ-Test
      - JQ-Test2
      - JQ-Test3
 
Now I have run the conversion tool and applied that to the ASA's I now get the following results.
 
Network Objects
- 10.1.1.1
- 10.2.2.2
- 10.3.3.3
 
Network Object Group
+ JQ Group
     - 10.1.1.1
     - 10.2.2.2
     - 10.3.3.3
 
I am aware that the naming convention on the ASA's are different to the FWSM as you can no longer use the "name 1.1.1.1 JQ-Test1" format but I was hoping that the conversion tool would do this for me.
 
Is there any way I can get the names of the object back without having to script something that takes the old FWSM format and convert it into an ASA format?

View 1 Replies View Related

Cisco Firewall :: 6509 - Standby FWSM Stuck In Sync After Reload

May 8, 2011

We have a setup of FWSMs configured in single mode in 6509 chassis. Both 6509 are configured in VSS. Recently I have upgraded the firmwre from 4.0(3) to 4.1(3).....before upgradation config sync was not having any problem.
 
After upgradation...If any one of the FWSM reload..while coming up it gets stuck in config sync and no command we can run on any of the unit and get the error as..
Configuration update in progress by another process. Also on stannby fwsm no running-config displays.
 
If we used # failover suspend-config on primary and then reloads the standby fwsm...standby boots up with startup config and when  # no failover suspend-config command runs on active fwsm..the sync started and completing succssfully within 15 sec..
 
Also failover works well..with #no failover active..

View 3 Replies View Related

Cisco Firewall :: 6509 - Replacing Faulty FWSM Module In Cluster

Apr 15, 2013

We have a faulty FWSM module in Cisco 6509 switch in Active/Standby cluster mode
 
We have purchased a refurbished FWSM module to replace it. It has the same FWSM OS 4.0 (4) and is in factory default configuration
 
What procedures should I follow to make this unit live and sync the config between the current active unit to this one.

View 1 Replies View Related

Cisco Firewall :: 6509 / Interface VLAN Stop Responding On FWSM Automatically

Aug 8, 2012

i  have been facing strange issue on FWSM (6509 switch). we have created a  vlan inteface for  server farm on fwsm and its stop responding  automatically and we need to give shut/ no shut command under that  interface to back into normal .

View 11 Replies View Related

Cisco Switching/Routing :: ASR 1002 Inter-chassis Redundancy

Sep 9, 2012

Can any share some useful links on how this works and how to configure it?  Do you still need to configure FHRP or does configuring redundancy take care of active/standby relationship between the ASR's?                  

View 2 Replies View Related

Cisco Switching/Routing :: Configure Dual SUP 7 On 4507 Chassis For Redundancy?

May 24, 2012

I need to configure a 4507 chassis with two SUP 7 installed. I havenot done SUP redundancy comnfiguration and i was owndering

View 9 Replies View Related

Cisco Firewall :: 6509 / FWSM VLAN Configuration Mismatch And Some VLAN Deleted

Aug 12, 2012

We  have 6509 VSS with FWSM Module and we have created two context on it, one is INTERNALL CONTEXT othe is EXTERNALL Context? We have spanned various VLANS in switches and FWSM context level.  All VLAN Gateways are configured in context level.
 
Activity description : We had planned migration of these devices into a new Datacenter, it was a planned activity. During  migration of devices from one Dc to a new DC  we broke the VSS and kept the primary running and removed the secondary switch and migrated this secondary to new DC  and powered this device ON in the new DC and checked all the config was very much fine but this device was OFF network as secondary was brought to new DC just to limit the downtime during the primary switch movement.
 
During the activity ( Primary switch movement )We powered off the Primary switch  and mean time before shifting into new Data center  We had brought up secondary switch which was already existing in the DC was put live in the network and it was working fine without any issues.
 
Later  we had moved  Primary into new data center and tried to put into VSS with the secondary , during this period the secondary device into went into RECOVERY MODE  and  primary device was not responding and devices  went off network and immediatly we  removed the VSL link and brought up  primary into production network without secondary online in the network ( Without VSS just stand alone switch ) network started working, but bringing up the primary we found that some of the VLANS in the FWSM was deleted and some VLAN had misconfiguration ( example : say original  VLAN  ip 10.200.112.1 has become  10.300.13.1 ) also some of the access list as well as SVI was deleted making configuration mismatch.
 
Wanted to know while syncronization b/n primary and secondary switch in VSS if we pull out VSL link would create this type of issues.

View 1 Replies View Related

Cisco Switching/Routing :: 6509 / Migrate VSS To New Set Of Chassis?

Dec 19, 2012

Currently have a pair of 6509 chassis setup with VSS. Only have the Sup and two line cards in each chassis. Would like to replace with a new pair of 6504E chassis. Is it possible to fail one chassis at a time and migrate to the new 6504E?

View 3 Replies View Related

Cisco WAN :: Remove IPSec VPN SPA Module From 6509 Chassis?

Feb 29, 2012

Need to remove the IPSec VPN SPA module from the 6509 chassis. Does the module is hot swappable or does the 6509 need to be turned off prior to removal.

View 2 Replies View Related

Cisco Switching/Routing :: Sup 720 MSFC3 (HOT) Reload In 6509 Chassis

Mar 9, 2013

We have a backup sup 720 which has a 2 gigabit ethernet though port channel, to another chassis. Suddenly UDLD detected an error and got into err disable, then this err disable didn't let the interface set to DOWN, and created a switch loop, then our Supervisor reloaded. I'd like to know what could have caused this reload. In my opinion could have a been the switch loop, but also I've been checking from the output interpreter the show tech and might have been a bug, the only one that could match in IOS version 12.2(33)SXH, is this one: url...
 
We're going to disable err-disable next time I guess and recover the link manually, apart from that what could have made the sup for crash and reload?

View 4 Replies View Related

Cisco Wireless :: WLC 4402 LAG Connection To 2 Different Chassis Of 6509 VSS Switch

Mar 28, 2012

I have inherited a 6509 VSS switch system as the network core and have the task of ensuring proper redundancy and redesign of the directly connected data center devices.  One of the connected devices (WLC 4402) physically appears to be connected to both switches - the WLC is in the same rack as VSS-Chassis1 so I can trace the fiber from WLC port 1 to gi1/1/22, the other fiber from the WLC port 2 goes into the floor and presumably over to VSS-Chassis2 gi2/1/22 (there is fiber connected there, I have link lights on both sides, and the port channel, Po200, on the VSS switch which is configured on gi1/1/22 is also configured on gi2/1/22).  My question pertains to the CDP neighbor output I get on the VSS switch: (truncated to include just the WLC) [code]

So my question, arising at least partly from the apparently misleading CDP information, is this:  How can I confirm that the WLC is correctly dual homed to both core switches? (short of tracing the cable)  I ask because there are several other devices (not WLCs) that need to have the dual homed connections confirmed.I tried a layer 2 trace route but for all macs associated with the WLC, the trace abborts with the error "Device has Multiple CDP neighbours on destination port."

View 2 Replies View Related

Cisco Switching/Routing :: Failed Supervisor On 6509 Chassis?

Jan 28, 2012

swapping out a failed supervisor card on a 6509 chassis?

View 6 Replies View Related

Cisco Switching/Routing :: Upgrade 6509-Chassis In VSS-Environment?

May 1, 2013

we have some pairs of 6509-VSS, which partially have old (no more officially supported) 6509-Chassis.All linecards in the VSS are the same (Sup 720-10GE-3C, 67XX).
 
We now bought some new 6509-E-Chassis and want to change the old chassis by the new ones in a ISSU manner, that means:
 
1. putting the partner, which chassis changes, in redundancy mode, switch it off, exchange chassis (old "Catalyst 6509", new "Catalyst 6509-E")

2. inserting the line-cards exactly in the same slots and connecting all cables

3. switch on the new chassis, witing to come up in VSS
 
I'm not sure of having to set the switch number for VSS (is that in the Sup?; configuration? or part of the chassis-memory?)
 
I've looked up cisco for some hints, but don't found anything.

View 5 Replies View Related

Cisco Switching/Routing :: 6509 And 6509E Chassis Physical Characteristics

Oct 18, 2012

Are there any physical characteristic differences between the 6509 and 6509-E chassis?

View 4 Replies View Related

Cisco Switching/Routing :: 6509 VSS Standby Chassis Reboot Trap

Dec 9, 2012

I have multiple 6509 vss switch. and i notice when the standby chassis reboot I didn't get any snmp trap, but I got when the active one reboot. my question is is there any mib out there for detecting and got a trap when standby reboot?

View 2 Replies View Related

Cisco Switching/Routing :: Is WS-SUP720-BASE Supported In 6509-E Chassis

Nov 29, 2010

I have a heck of a time finding this kind of information on the cisco site...Is the WS-SUP720-BASE line card a fully supported module in the 6509-E chassis?

View 4 Replies View Related

Cisco WAN :: Upgrade Sup720 6509 Chassis - Configure Sup2T Management Ports?

Jul 1, 2012

We've just invested in a pair of Sup2Ts to upgrade a Sup720 6509 chassis but I'm unsure exactly how the management port(s), aka the Connectivity Management Processor (CMP), should be configured (and patched) in a dual supervisor system?Is each CMP an independent entity or is the management interface configuration (IP address, gateway, etc) replicated between supervisors?If it's the latter then do both management ports need to be physically connected at the same time?

View 1 Replies View Related

Cisco Switching/Routing :: 6509 SSO Redundancy IOS Upgrade

Sep 9, 2012

I have a 6509 switch with SSO Redundancy (STANDBY HOT) with IOS ver 12.2(17d)SXB11, RELEASE SOFTWARE (fc1) (c6k222-jk9sv-mz.122-17d.SXB11.bin). I need to upgrade the IOS on this switch.I have 512MB Memory on the switch and 40144896 bytes free on Disk0.which IOS is the latest version to upgrade and also give me some hints for IOS upgrade on this switch?

View 7 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved