Cisco Firewall :: FWSM ACL / NAT With 6503

Jan 15, 2012

We recently deployed a FWSM on our 6503-e boxes (w/ sup720).  NAT is working (PAT) but the issue I am seeing is private traffic from remote sites is not being allowed through the FW.   I was able to get the remote site to ping the FWSM itself (inside address), but no hosts behind it.  Maybe an ACL issue? Also when I turn off NAT on the remote end, I can than access everything (We are NATng on both ends).   Im a routing guy by nature so I will defer this to the security guys out there.
 
Topology
 
Hosts (inside/10.15.25.0/24) > FWSM  (outside/public IP) -> Core Router -> MPLS CLOUD -> Core Router (NATng) - > Hosts (192.168.1.0/24)

ACLs applied to inside/outside interface
 
FWSM# show access-list ATX-ALLOW-IN
access-list ATX-ALLOW-IN; 15 elements
access-list ATX-ALLOW-IN extended permit tcp any any (hitcnt=222)
[Code]....

View 3 Replies


ADVERTISEMENT

Cisco Firewall :: 6500 - FWSM - Not Passing Traffic Through Firewall

May 3, 2011

We have 2 FWSM modules in each 6500 switches. 1st module is having 04 firewall vlan groups with 18 vlan interfaces in a single context firewall. All are working fine with no issues. Recently we create one more vlan on MFSC and add into the same firewall module. However newly created vlan inside the FW is not able to communicate with outside and also outside users not able to reach newly created subnet. But within the firewall zones (other interfaces) it can communicate. Once we did packet capture we noticed that its hitting firewall outside interface only and when we ping we got TTL expired error. we have default routes to outside and there's no any route inside as new segment is within the firewall (no any hop).
 
I guess there's no limitation on number of vlans that we can assign on one firewall eventhough there is a limitation for number of vlan-group which is 16 max (but we are within that limit).

View 2 Replies View Related

Cisco WAN :: 6503 Boot Variable Is Getting Wiped

Feb 9, 2011

I've got a 6503, SupII/MSFC running Native code, so I'm pointing the boot variable to disk0: (bootflash is not large enough for the image file).  In using the wr erase, the boot variable is getting wiped as the wr erase removes all nvram files, and apparently the boot variable is stored there.  I also tried the erase start, which also hits everything in nvram. 

So, any clean way to wipe a config without forcing the router into ROMMON to reset the boot variable, or do I need to just expect that is part of the standard approach?

View 1 Replies View Related

Cisco Firewall :: Difference Between ASA-SM1 And FWSM

Apr 1, 2013

Can any1 tell me wat is the difference between ASA-SM1 and FWSM.

View 2 Replies View Related

Cisco Firewall :: FWSM Upgrade From 4.0(4) To 4.1(8)?

Apr 10, 2012

I want to upgrade a pair of FWSM in active failover from 4.0(4) to 4.1(8) i just want to double check the process. i have tftp access to the primary at the minute. i cannot access the same tftp server with the standby. do i need flip over to the standby to be able to tftp the image across?
 
failover activehostname# changeto system 
hostname# copy tftp://x.x.x.x/c6svc-fwm-k9.4-1-8.bin flash:image
hostname# copy tftp://x.x.x.x/asdm-622f.bin flash:asdm
 hostname# reload 
 
Once i have the images loaded i reload both at the same time?[URL]

View 4 Replies View Related

Cisco Firewall :: FWSM Upgrade 3.2 To 4.0.4 For VSS?

Dec 17, 2011

I am planning for an VSS in Core but firstly I need to upgrade FWSM which is at 3.2 Ver to 4.0.4 (min release) I have checked software dependencies but not sure about Hardware Dependency  on Fwsm and Chassis for Eg. Rommon Upgrade on Chassis.

View 7 Replies View Related

Cisco Firewall :: Upgrading Fwsm From 3.1(11) To 4.x?

Jun 26, 2011

I wanna upgrade FWSM Version 3.1(11) to latest 4.x version is this possible or i have to upgrade first to 3.2 and then to 4.x?

Is there any changes in configuration commands that i need to know? The version that 6500 running is s72033-advipservicesk9_wan-mz.122-18.SXF14.bin,an upgrade to 6500 is needed also?And if so what ios version will i put?Also which is the asdm supported version?

View 3 Replies View Related

Cisco Switching/Routing :: Migrating Cat 6503-E VSS To Cat 6509E VSS

Aug 7, 2012

I want to migrate a Cat 6503-E VSS to Cat 6509E VSS. We plan to use the same supervisor that we have on the Cat6503E, for minimizing the configuration change on the Doing this, the vss link will need to be changed, due to the fact that the supervisor slot will change with the Cat 6509, slot 5 instead of 1.

Question: is there a way to just change the vsl-link interface on a existing VSS ?

View 3 Replies View Related

Cisco Switching/Routing :: 6503 Sup-2T Unable To Get Into ROMmon

Apr 11, 2013

I have an issue with a customers 6503 with Sup-2T cards, where we are locked out of the console due to an authentication configuration error. So tried several times to get the card into rommon, with no success.
 
Checking through the various documents on CCO I dont find any reference to rommon on this card, but do find information on using the CMP to support the supervisor. I logged into the CMP but couldn't find a way from there to do a password reccovery either.So, is the `normal' IOS rommon/password recovery method supported.

View 2 Replies View Related

Cisco Firewall :: 6500 - FWSM And ACE S/W Compatibility

Aug 14, 2011

We have a pair of 6500s with Sup720 running 12.2(33)SXI3. Each has an ACE-20 (s/w A2(2.0)) and FWSM (s/w v3.2(15)). We have reached a limit on the number of rules we can configure on the FWSM, and have determined that we shall upgrade to 4.1(5), with ASDM to 6.2(2)F. A question has been raised regarding the s/w on the ACE-20 modules. Do we need to upgrade them as well?

View 2 Replies View Related

Cisco Firewall :: ASA 8.3 And Higher Compared To FWSM

Oct 1, 2012

ASA code 8.3 and higher uses NAT objects and totally changes the NAT rule config. I am new to FWSM .... but was wondering if this comparable ? I am lookinig at upgrading FWSM 3.1(16) to a higher 4.1 version .... but have a feeling this could be a huge task if NAT config changes as with the ASA's

View 2 Replies View Related

Cisco Firewall :: How To Configure A FWSM By ASDM 6.2f

May 11, 2012

am trying to config a FWSM by ASDM 6.2f.there are formerly configured interfaces and new interfaces i created.when i add a new access rule it gets added only to all the old interfaces but not to the new ones i created.
 
1. what wrong with the new interfces i created?

2. whats the logic of auto adding a rule to "all" interfaces , the rules are incoming rules  specific to interfaces or groups , why add the to the rule to  "all" intefaces?.

View 3 Replies View Related

Cisco Firewall :: Upgrade From FWSM To ASA 5555Xs?

May 22, 2013

We would like to decommission our FWSMs and upgrade to the ASA 5555Xs. This leads me to ask the following: What would be the most efficient way of doing this without any interruption to production? How to successfully accomplish this?

View 1 Replies View Related

Cisco Firewall :: FWSM (in 6509) Is Not Coming Up?

Oct 29, 2012

our FWSM (in 6509) is not coming up, when tried to sesssion up using "Session slot 1 proc 1" command,It is giving error , "Tyring 127.0.0.11 .....connection timed out remote host not responding".
 
In "show mod" command output at Switch in IOS console:  under Card Type Section:  it is showing Model & Serial Number correctly,  Under MAC address sectino: displaying some MAC address But in Online Diag Status, it showing "Unknown" for Module 1.
 
We tried re-seating in other slots, but of no use. Giving same error. Some of other forms are saying it is the issue with 128 Mb CF image problem, FWSM is no more reachable from 6509 IOS console. We even tried using FWSM console (using PC-Conse & LCP Console) but FWSM is not contactable. 

View 1 Replies View Related

Cisco Firewall :: Unable To Login In FWSM 3.2

Apr 13, 2011

I  am having two dc switches with FWSM modules installed. DC switch1 FWSM  (Ver 3.2(12) is wokring as active and Secondary DC switch2 FWSM (ver  3.2.(12) is in standby mode.
 
From  yesterday I am trying to login primary FWSM, It is accepting my  username and credentials but prompting again for username please refer  below
 
DXB-DC1>session slot 5 p 1The default escape character is Ctrl-^, then x.You can also type 'exit' at the remote prompt to end the sessionTrying 127.0.0.51 Open. [code]

View 1 Replies View Related

Cisco Firewall :: FWSM Reset With 6500

Feb 3, 2012

I have had a strange issue with a pair of FWSM's in 2 6500's, it seems there was a failover but both module's have been reset.
 
CAT1
Feb 03 17:08:46.525: %SNMP-5-MODULETRAP: Module 8 [Down] Trap Feb 03 17:08:46.522: SP: The PC in slot 8 is shutting down. Please wait ...Feb 03 17:09:01.525: SP: shutdown_pc_process:No response from module 8 Feb 03 17:09:11.382: %C6KPWR-SP-4-DISABLED: power to module in slot 8 set off (Reset) Feb 03 17:10:56.093: %DIAG-SP-6-RUN_MINIMUM: Module 8: Running Minimal Diagnostics...Feb 03 17:10:59.796: %SVCLC-5-FWVTPMODE: VTP
[Code]...

View 1 Replies View Related

Cisco Firewall :: Can Upgrade FWSM 4.0.3 To 4.0.17 With Chassis IOS

Jul 9, 2012

Can I upgrade FWSM 4.0.3 to 4.0.17  with Chassis IOS s72033-adventerprisek9_wan-mz.122-33.SXH4.bin ?
 
In chassis's slot we have ACE and FWSM slot also. if I will upgrade chassis it will reboot ACE too.I do not want to reload Chassis.

View 2 Replies View Related

Cisco Firewall :: C6509 - Can't Connect FWSM

Sep 27, 2012

I'm running two C6509 Chassis with FWSM and ACE module install on each chasiss.I have no problem with session into 1 FWSM and 2 ACE modules.But 1 FWSM module can't be access by session command.As I understand two FWSM module status is OK, and working fine.When I tried to session into FWSM, I got these messages..
 
[code]....

View 2 Replies View Related

Cisco Firewall :: How To Upgrade Fwsm Image From 3.1(10) To 4.0(8)

Jan 11, 2010

I need to upgrade the fwsm image from 3.1(10) to 4.0(8). Can i do it directly from 3.1(10) to 4.0(8) ?Do i need to upgrade other image also along with Firewall version 4.0(8)?
 
[code]....

View 5 Replies View Related

Cisco Firewall :: 6509 - FWSM Log Messages

Jul 16, 2011

I think I got a strange behavior on a context of my WS-SVC-FWM-1 (on a Catalyst 6509 running IOS 12.2(18)SXF17a) that is running FWSM Firewall Version 4.1(3). This context sends these log messages every ten minutes:
 
Jul 17 2011 23:31:16: %FWSM-6-302010: 0 in use, 0 most used
Jul 17 2011 23:31:17: %FWSM-6-302010: 2245 in use, 107133 most used
[code]...
 
If I issue the "show conn" three seconds later the log message, the output I got is: FWSM#   sh conn 1041 in use, 107133 most used
 
In another context on the same FWSM the log message sent every ten minutes is just this one:
 
Jul 17 2011 23:31:17: %FWSM-6-302010: 1358 in use, 72503 most used
Jul 17 2011 23:41:22: %FWSM-6-302010: 1590 in use, 72503 most used
 
In this case there is no the log message where the "in use" field and "most used" field are 0 (zero). why does the context send the message with the "in use" field and "most used" field 0 (zero).

View 1 Replies View Related

Cisco Firewall :: 6509 / 2811 - NAT At FWSM

May 17, 2011

I have attached a drawing of our network.  We have two 6509's connected to two Cisco 2811 (onsite) that the ISP owns. I am trying to get one side up and running before I worry about redundancy and so forth.  For this reason I have set all the HSRP priorities to 110 on the left 6509.  I have HSRP running between the ISP routers and V LAN 101 of the 6509's.  This works as I can ping yahoo and Google just fine from the 6509 switch.  I can't get from my laptop connected to V LAN 23 to the internet. 

It doesn't even attempt to NAT as there are no translations.  I have public address assigned by my ISP configured between the ISP routers and my 6509 on V LAN 101.  I then have the public address assigned to V LAN 100.  I configured V LAN 100 on the switch and V LAN 100 on the FWSM with the IP address in the drawing.  I have my NAT statements and route in my FWSM according to the drawing as well.  On the switch, I have a default route to X.X.12.19 which is the VIP between the ISP routers.  I can reach anything on the inside of my network, including the old network addresses from V LAN 23.  
 
1. Is it best to do NAT at the FWSM or should I do it on the MSFC connected to the ISP routers?  
2. If I have to configure NAT at the FWSM, does this requires me to extend the public network down to the FWSM? 
3. I'll take any examples you may have as I am stuck.

View 2 Replies View Related

Cisco Firewall :: 6500 - FWSM Linux

Dec 20, 2012

We run a 6500 with an FWSM with multiple security contexts as well as cascading contexts with a "shared V LAN" . There is a problem with regards to Linux machines and our shared network.

For example, we have three Linux machines in production, each in three separate V LAN's. For me to communicate to these boxes from one V LAN to another I must first ping the server. If I do not ping the server it will not bring up a connection like ssh or HTTP, etc. Below is the error I get from the FWSM that hosts the Linux server, but like I said once I ping the server the error goes away. We only have this problem with Linux machines, and it is a problem for all three of them. Is the FWSM having issues understanding something with all three Linux boxes? Below is the error I get at first, when I try to SSH from one V LAN to another V LAN with the Linux machine. 

6 Dec 21 2012 16:33:54 106015 10.255.12.109 22 10.255.1.30 63000
Deny TCP (no connection) from 10.255.12.109/22 to 10.255.1.30/63000 flags SYN ACK on interface inside.  
 
Below is what happens when I initiate a ping to the Linux Server and then ssh again. Notice it builds the connection with no problem after the ping. During the ping it builds the dynamic translation, and then when I ssh it builds the TCP connection. Do you know why this could be?

6 Dec 21 2012 16:35:08 305009 10.255.12.109 10.255.12.109
[Code]....

View 7 Replies View Related

Cisco WAN :: Running MPLS - 6503 Switch Or 7201 Router?

Oct 16, 2012

I am looking at running MPLS from from one datacentre to the other (we have a layer2 interconnect and can run jumbo frames) I need about 70 access ports (each in a seperate VRF) at the new datacentre
 
I am looking at :
 
2x 6503'-Es with sup720-3B and a 48x port linecard
or
2x 7201 router with 2x 2960-S layer 2 access switches.

View 1 Replies View Related

Cisco Switching/Routing :: 6503 E Series Boot Image

Dec 14, 2012

I have a cisco 6503 - e series switch which runs c6sup22-psv-mz.121-26.E4.bin. Both superviser engine and MSFC2 card run the same IOS image i guess. In my boot flash their is another image c6msfc2-jsv-mz.121-4.E1. o what is the difference between these images c6msfc2-jsv-mz.121-4.E1 and  c6msfc-boot-mz.121-4.E1.

View 5 Replies View Related

Cisco Firewall :: 3.2 (18) - URL Filtering In FWSM Without External Server

May 18, 2011

I have an FWSM running in multiple context mode running 3.2(18) code.  I have 3 urls that I would like to block so I can't justify the cost of an external URL filtering server.  I have found a way to filter individual URLs on the ASA but the same configuration does not seem to be available on the FWSM.  At least not on my code. Any way to do this other than resolving the hostnames and blocking the current IP addresses?

View 1 Replies View Related

Cisco Firewall :: 7604 FWSM Boot Failure

Dec 20, 2012

I have 7604 router with FWSM module in module 3.First of all the FWSM CF has been damaged, not physically. I bought the new same compact flash (size, partnumber, etc.). Downloaded the software 3.2 for FWSM, and ASDM from Cisco website. I realized that the procedure of creating new CF for FWSM is quite diffucult: creating 1-5 partitions, where 1 - is MP, and 4th - application partition. According to cisco documentation - the default boot partition is the 4th, so I partitioned from 7604 the CF into 4 partitions (partition disk1: <1-4> maximum) and copied the software and ASDM to the 4th partition (disk1:3:). Removed the CF from the router and put it into the FWSM module.

View 1 Replies View Related

Cisco Firewall :: Recommended Code For ASA5580 / ACE And FWSM?

Mar 24, 2011

We are in the process of building a new DC and would like to know which is the recommended version of code to run on the following:
 
Firewall Services Module
Cisco ASA5580, 5550, 5520
ACE module

View 4 Replies View Related

Cisco Firewall :: 6500 - FWSM With Multiple Connections?

Aug 29, 2012

There is a 6500 switch with fwsm. We have extended 2 vlans from the ISP into the FWSM. Also there are atleast 10 other vlans for our internal network. We would like say half of the internal vlans to go out of the 1st ISP vlan and the remaining half from the 2nd ISP vlan. Is there a way we can do this in the FWSM?

View 2 Replies View Related

Cisco Firewall :: Cat6500 To Add Vlan Group For Fwsm

May 22, 2012

i have fwsm in cat6500, i have one firewall vlan group which is in firewall module 1 vlan group 10. I need tocreate another vlan  group and add to firewall module 1 vlan group 10, 20. i need to have zero downtime.

View 2 Replies View Related

Cisco Firewall :: 6509 / High Connections On FWSM?

Oct 19, 2011

I am having issues trying to track down what is causing a high number of connection on our FWSM in our core 6509 switch. I recently upgraded my FWSM to 3.1(20) and I'm looking for a tool to be able to find the culprit. When I receive these messages I try to get onto the firewall in time to be able to get information regarding this issue but by the time I do the device recovers. Is there a way to tweat the threshold of the SNMP trap for high connections? Is there any way I can retreive this information via SNMP? Is there are command that will allow me to extract the local IP making the most connections?

View 1 Replies View Related

Cisco Firewall :: Fail Context From One FWSM Over To Other 6500

Oct 23, 2012

Firstly is this the right forum to post threads about FWSM's. We have 2 FWSM's in two seperate 6500 switches. There are a number of contexts on each FWSM.I want to fail a context from one FWSM over to the other 6500 and FWSM. Can you tell me how I can do that? Do I need to do it in the admin context and do I need to do it on the admin context of each 6500?

View 7 Replies View Related

Cisco Firewall :: FWSM 4.1.8 Maintenance Software And Upgrade

Jul 3, 2012

I have few questions on FWSM software upgrade.
 
1) I could not find the availale maintenance software under software donwload section?
 
2) what is the maintenance software version required for fwsm 4.1.8 upgrade (this does not have on the release note) url...

3) what is the main difference when you upgrad fwsm using following two methods:

- Installing to the current application partition from the FWSM CLI
-  Installing to any application partition from the maintenance partition
 
4) how can we verify the file integrity after copied from tftp/ftp server (because it does not support verify command as in IOS)
 
5) how can we see the copied files in the fwsm (it does not show with show flash or dir commands)

View 4 Replies View Related

Cisco Firewall :: FWSM Acl Rules Rv042 Not Working At All

Sep 20, 2011

On my RV042 (I used it for a couple of years now without issues), the DIAG led light amber (steady). It's not documented in the user manual.User manual says only:,Diag  (Red)  The Diag LED lights up when the Router is not ready for use. It turns off when the Router is ready for use.",Router does not work anymore and I can't access its web page as I used to do before this problem.I did a reset to factory default (reset button hold for more than 30 sec.) but it didn't change anything.

View 1 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved