Cisco Infrastructure :: Difference Between ASA-SM1 And FWSM
Mar 30, 2013What is the difference between ASA-SM1 and FWSM and what is the throughput of it?
View 1 Replies
ADVERTISEMENT
Cisco Firewall :: Difference Between ASA-SM1 And FWSM
Apr 1, 2013Can any1 tell me wat is the difference between ASA-SM1 and FWSM.
View 2 Replies View RelatedCisco Infrastructure :: Difference Between RPS 300 And 675
Jan 8, 2013What is the difference between RPS 300 and RPS 675?
View 3 Replies View RelatedCisco Infrastructure :: Difference Of Getting CON-SNT-SMS-1 Instead Of CON-SNT-2960S4FS And CON-SNT-2964STL
Jul 21, 2012What is the difference of getting CON-SNT-SMS-1 instead of CON-SNT-2960S4FS and CON-SNT-2964STL?
View 3 Replies View RelatedCisco Infrastructure :: Difference Between WS-3560-48ts-s V02 And V03?
Mar 27, 2011What is the difference between v02 and v03 of ws-3560-48ts-s switches? is it just small corrections or functionality?
View 2 Replies View RelatedCisco Infrastructure :: Difference Between RJ45 And RJ48
Jun 27, 2002What is the difference between rj45 and rj48 connectors? Are they interchangeable?
View 7 Replies View RelatedCisco :: Load Balance Between ASA And FWSM?
Aug 6, 2012What is the best way to load balance traffic between an FWSM and ASA 5520? Both are attached to a 6509-E (in seperate VLANs). The problem is the FWSM doesn't support any dynamic routing protocols (in multi context mode). So with my limited knowledge I don't see a way to do this.
View 8 Replies View RelatedCisco Firewall :: FWSM Upgrade From 4.0(4) To 4.1(8)?
Apr 10, 2012I want to upgrade a pair of FWSM in active failover from 4.0(4) to 4.1(8) i just want to double check the process. i have tftp access to the primary at the minute. i cannot access the same tftp server with the standby. do i need flip over to the standby to be able to tftp the image across?
failover activehostname# changeto system
hostname# copy tftp://x.x.x.x/c6svc-fwm-k9.4-1-8.bin flash:image
hostname# copy tftp://x.x.x.x/asdm-622f.bin flash:asdm
hostname# reload
Once i have the images loaded i reload both at the same time?[URL]
Cisco Firewall :: FWSM Upgrade 3.2 To 4.0.4 For VSS?
Dec 17, 2011I am planning for an VSS in Core but firstly I need to upgrade FWSM which is at 3.2 Ver to 4.0.4 (min release) I have checked software dependencies but not sure about Hardware Dependency on Fwsm and Chassis for Eg. Rommon Upgrade on Chassis.
View 7 Replies View RelatedCisco VPN :: VPN Access To FWSM LAN Through A 2801
Mar 26, 2011I have a FWSM in my 6509, this firewall is managing three VLANs, one of which holds a file server. As you all know, FWSM do not support VPN like the ASAs and PIXs do. I have been trying to add remote access to this file server LAN all week. The only VPN device i have is a 2801 router.
first layout: VPN router behind FWSMstatic translation from FWSM LAN (private) to VPN WAN (public)default route was facing back at FWSMip address pool was to be NAT'd on the interface facing the FWSM the idea was that my VPN address pool would be NAT'd back to the FWSM on it's VLAN. since the FWSM was managing this VLAN and recognized the source IP of the translated address pool, i would have access to my precious file server.
second layout: VPN router fa 0/1 on a /30 with 6509 (public)VPN router fa 0/0 still on the same LAN as FWSM (private)address pool for VPN once again NAT'd to fa 0/0default route pointed to fa 0/1static route of FWSM LAN pointed to fa 0/0 this idea was to have more of a 'inside' and 'outside' interface on the VPN router. this too did not work, having used every trick in the book, i could still not ping anything on the FWSM LAN while VPN'd in the network (aside from the LAN interface on my router)
trace route was showing that the all routes were headed out fa 0/1 (default route) and all to my FWSM died. i really don't think my address pool is being NAT'd, though my route map statement applied to the NAT policy is permitting my VPN address pool.
I am new to VPN technology, one of those things that happened to land on my lap. how this layout could work? there are no good VPN Remote access walkthroughs for a situation like this (2801 allowing access to a FWSM controlled LAN)
Cisco Firewall :: Upgrading Fwsm From 3.1(11) To 4.x?
Jun 26, 2011I wanna upgrade FWSM Version 3.1(11) to latest 4.x version is this possible or i have to upgrade first to 3.2 and then to 4.x?
Is there any changes in configuration commands that i need to know? The version that 6500 running is s72033-advipservicesk9_wan-mz.122-18.SXF14.bin,an upgrade to 6500 is needed also?And if so what ios version will i put?Also which is the asdm supported version?
Cisco Firewall :: FWSM ACL / NAT With 6503
Jan 15, 2012We recently deployed a FWSM on our 6503-e boxes (w/ sup720). NAT is working (PAT) but the issue I am seeing is private traffic from remote sites is not being allowed through the FW. I was able to get the remote site to ping the FWSM itself (inside address), but no hosts behind it. Maybe an ACL issue? Also when I turn off NAT on the remote end, I can than access everything (We are NATng on both ends). Im a routing guy by nature so I will defer this to the security guys out there.
Topology
Hosts (inside/10.15.25.0/24) > FWSM (outside/public IP) -> Core Router -> MPLS CLOUD -> Core Router (NATng) - > Hosts (192.168.1.0/24)
ACLs applied to inside/outside interface
FWSM# show access-list ATX-ALLOW-IN
access-list ATX-ALLOW-IN; 15 elements
access-list ATX-ALLOW-IN extended permit tcp any any (hitcnt=222)
[Code]....
Packet Capture In FWSM?
Oct 1, 2012when performing packet capture in a FWSM
[code]...
Cisco :: Configuring FWSM With 2 Internet Connections?
Aug 24, 2012I have 2 cisco 6500 switches with FWSM running HSRP with an ISP. I need to add another ISP into this configuration for ISP failover. The original ISP i.e ISP 1 has given us a Vlan and we have configured a default route into the FWSM to go through it. Now i have 2nd ISP which has given us another Vlan but i would like to know how can i configure default route for this 2nd ISP as i already have one for the 1st ISP.
View 4 Replies View RelatedCisco WAN :: Which IOS Is For Router 7606 To Accept FWSM
Nov 10, 2011I need to put a FWSM and a line card WS-X6148A-GE-TX to a router 7606. The FWSM version is 3.2(13). The router is running IOS 12.1(18)SXD3. The Cisco document here says the required IOS for router 7606 is 12.2(18)SXF or higher. I have downloaded the IOS 12.2(33)SRD4 and loaded it to the flash card. When I turn the router on, it doesn't load the new IOS and goes to rommon. Which IOS I should use to make the router 7606 work and accept the FWSM.
View 2 Replies View RelatedCisco Firewall :: 6500 - FWSM And ACE S/W Compatibility
Aug 14, 2011We have a pair of 6500s with Sup720 running 12.2(33)SXI3. Each has an ACE-20 (s/w A2(2.0)) and FWSM (s/w v3.2(15)). We have reached a limit on the number of rules we can configure on the FWSM, and have determined that we shall upgrade to 4.1(5), with ASDM to 6.2(2)F. A question has been raised regarding the s/w on the ACE-20 modules. Do we need to upgrade them as well?
View 2 Replies View RelatedCisco Firewall :: ASA 8.3 And Higher Compared To FWSM
Oct 1, 2012ASA code 8.3 and higher uses NAT objects and totally changes the NAT rule config. I am new to FWSM .... but was wondering if this comparable ? I am lookinig at upgrading FWSM 3.1(16) to a higher 4.1 version .... but have a feeling this could be a huge task if NAT config changes as with the ASA's
View 2 Replies View RelatedCisco Firewall :: How To Configure A FWSM By ASDM 6.2f
May 11, 2012am trying to config a FWSM by ASDM 6.2f.there are formerly configured interfaces and new interfaces i created.when i add a new access rule it gets added only to all the old interfaces but not to the new ones i created.
1. what wrong with the new interfces i created?
2. whats the logic of auto adding a rule to "all" interfaces , the rules are incoming rules specific to interfaces or groups , why add the to the rule to "all" intefaces?.
Cisco Firewall :: Upgrade From FWSM To ASA 5555Xs?
May 22, 2013We would like to decommission our FWSMs and upgrade to the ASA 5555Xs. This leads me to ask the following: What would be the most efficient way of doing this without any interruption to production? How to successfully accomplish this?
View 1 Replies View RelatedCisco Firewall :: FWSM (in 6509) Is Not Coming Up?
Oct 29, 2012our FWSM (in 6509) is not coming up, when tried to sesssion up using "Session slot 1 proc 1" command,It is giving error , "Tyring 127.0.0.11 .....connection timed out remote host not responding".
In "show mod" command output at Switch in IOS console: under Card Type Section: it is showing Model & Serial Number correctly, Under MAC address sectino: displaying some MAC address But in Online Diag Status, it showing "Unknown" for Module 1.
We tried re-seating in other slots, but of no use. Giving same error. Some of other forms are saying it is the issue with 128 Mb CF image problem, FWSM is no more reachable from 6509 IOS console. We even tried using FWSM console (using PC-Conse & LCP Console) but FWSM is not contactable.
Cisco Firewall :: Unable To Login In FWSM 3.2
Apr 13, 2011I am having two dc switches with FWSM modules installed. DC switch1 FWSM (Ver 3.2(12) is wokring as active and Secondary DC switch2 FWSM (ver 3.2.(12) is in standby mode.
From yesterday I am trying to login primary FWSM, It is accepting my username and credentials but prompting again for username please refer below
DXB-DC1>session slot 5 p 1The default escape character is Ctrl-^, then x.You can also type 'exit' at the remote prompt to end the sessionTrying 127.0.0.51 Open. [code]
Cisco Firewall :: FWSM Reset With 6500
Feb 3, 2012I have had a strange issue with a pair of FWSM's in 2 6500's, it seems there was a failover but both module's have been reset.
CAT1
Feb 03 17:08:46.525: %SNMP-5-MODULETRAP: Module 8 [Down] Trap Feb 03 17:08:46.522: SP: The PC in slot 8 is shutting down. Please wait ...Feb 03 17:09:01.525: SP: shutdown_pc_process:No response from module 8 Feb 03 17:09:11.382: %C6KPWR-SP-4-DISABLED: power to module in slot 8 set off (Reset) Feb 03 17:10:56.093: %DIAG-SP-6-RUN_MINIMUM: Module 8: Running Minimal Diagnostics...Feb 03 17:10:59.796: %SVCLC-5-FWVTPMODE: VTP
[Code]...
Cisco Firewall :: Can Upgrade FWSM 4.0.3 To 4.0.17 With Chassis IOS
Jul 9, 2012Can I upgrade FWSM 4.0.3 to 4.0.17 with Chassis IOS s72033-adventerprisek9_wan-mz.122-33.SXH4.bin ?
In chassis's slot we have ACE and FWSM slot also. if I will upgrade chassis it will reboot ACE too.I do not want to reload Chassis.
Cisco WAN :: Slow Performance With FWSM In Different DMZ 6509
Aug 8, 2012i am feeling an issue related to 2 x 6509 with fwsm.
Mod Ports Card Type Model --- ----- -------------------------------------- ------------------ ----------- 1 6 Firewall Module WS-SVC-FWM-1 2 48 CEF720 48 port 1000mb SFP WS-X6748-SFP 3 48 CEF720 48 port 10/100/1000mb Ethernet WS-X6748-GE-TX 4 48 CEF720 48 port 10/100/1000mb Ethernet WS-X6748-GE-TX 5 5 Supervisor Engine 720 10GE (Active) VS-S720-10G
Hw Fw Sw Status ------------ ------------ ------- 4.3 7.2(1) 4.1(2) Ok 1.12 12.2(14r)S5 12.2(33)SXH3 Ok 3.0 12.2(18r)S1 12.2(33)SXH3 Ok 3.0 12.2(18r)S1 12.2(33)SXH3 Ok 2.1 8.5(2) 12.2(33)SXH3 Ok
on fwsm we have different dmz for different application. mostly of Oracle (1521 port) to application means seperate one. problem is oracle people reported the slow performace when exporting dump from once vlan to another. before that they are using 3com technology (network) and on this its ok. time difference is double from old to new.
i had sniffed the traffic also and found alot of TCP OUT OF ORDERS errors. i read that this is the bug which is resolved in 4.0.
Cisco Firewall :: C6509 - Can't Connect FWSM
Sep 27, 2012I'm running two C6509 Chassis with FWSM and ACE module install on each chasiss.I have no problem with session into 1 FWSM and 2 ACE modules.But 1 FWSM module can't be access by session command.As I understand two FWSM module status is OK, and working fine.When I tried to session into FWSM, I got these messages..
[code]....
Cisco Firewall :: How To Upgrade Fwsm Image From 3.1(10) To 4.0(8)
Jan 11, 2010I need to upgrade the fwsm image from 3.1(10) to 4.0(8). Can i do it directly from 3.1(10) to 4.0(8) ?Do i need to upgrade other image also along with Firewall version 4.0(8)?
[code]....
Cisco Firewall :: 6509 - FWSM Log Messages
Jul 16, 2011I think I got a strange behavior on a context of my WS-SVC-FWM-1 (on a Catalyst 6509 running IOS 12.2(18)SXF17a) that is running FWSM Firewall Version 4.1(3). This context sends these log messages every ten minutes:
Jul 17 2011 23:31:16: %FWSM-6-302010: 0 in use, 0 most used
Jul 17 2011 23:31:17: %FWSM-6-302010: 2245 in use, 107133 most used
[code]...
If I issue the "show conn" three seconds later the log message, the output I got is: FWSM# sh conn 1041 in use, 107133 most used
In another context on the same FWSM the log message sent every ten minutes is just this one:
Jul 17 2011 23:31:17: %FWSM-6-302010: 1358 in use, 72503 most used
Jul 17 2011 23:41:22: %FWSM-6-302010: 1590 in use, 72503 most used
In this case there is no the log message where the "in use" field and "most used" field are 0 (zero). why does the context send the message with the "in use" field and "most used" field 0 (zero).
Cisco Firewall :: 6509 / 2811 - NAT At FWSM
May 17, 2011I have attached a drawing of our network. We have two 6509's connected to two Cisco 2811 (onsite) that the ISP owns. I am trying to get one side up and running before I worry about redundancy and so forth. For this reason I have set all the HSRP priorities to 110 on the left 6509. I have HSRP running between the ISP routers and V LAN 101 of the 6509's. This works as I can ping yahoo and Google just fine from the 6509 switch. I can't get from my laptop connected to V LAN 23 to the internet.
It doesn't even attempt to NAT as there are no translations. I have public address assigned by my ISP configured between the ISP routers and my 6509 on V LAN 101. I then have the public address assigned to V LAN 100. I configured V LAN 100 on the switch and V LAN 100 on the FWSM with the IP address in the drawing. I have my NAT statements and route in my FWSM according to the drawing as well. On the switch, I have a default route to X.X.12.19 which is the VIP between the ISP routers. I can reach anything on the inside of my network, including the old network addresses from V LAN 23.
1. Is it best to do NAT at the FWSM or should I do it on the MSFC connected to the ISP routers?
2. If I have to configure NAT at the FWSM, does this requires me to extend the public network down to the FWSM?
3. I'll take any examples you may have as I am stuck.
Cisco Firewall :: 6500 - FWSM Linux
Dec 20, 2012We run a 6500 with an FWSM with multiple security contexts as well as cascading contexts with a "shared V LAN" . There is a problem with regards to Linux machines and our shared network.
For example, we have three Linux machines in production, each in three separate V LAN's. For me to communicate to these boxes from one V LAN to another I must first ping the server. If I do not ping the server it will not bring up a connection like ssh or HTTP, etc. Below is the error I get from the FWSM that hosts the Linux server, but like I said once I ping the server the error goes away. We only have this problem with Linux machines, and it is a problem for all three of them. Is the FWSM having issues understanding something with all three Linux boxes? Below is the error I get at first, when I try to SSH from one V LAN to another V LAN with the Linux machine.
6 Dec 21 2012 16:33:54 106015 10.255.12.109 22 10.255.1.30 63000
Deny TCP (no connection) from 10.255.12.109/22 to 10.255.1.30/63000 flags SYN ACK on interface inside.
Below is what happens when I initiate a ping to the Linux Server and then ssh again. Notice it builds the connection with no problem after the ping. During the ping it builds the dynamic translation, and then when I ssh it builds the TCP connection. Do you know why this could be?
6 Dec 21 2012 16:35:08 305009 10.255.12.109 10.255.12.109
[Code]....
Cisco :: FWSM Communication Between Same Security Level Interfaces
Sep 21, 2012I have 2 dmz interfaces(dmz1 and dmz2) with security level 50. I am able to ping the hosts on dmz2 from dmz1. I am running a service on a dmz2 host on port 82 but i am not able to access that service from dmz1. Also, i have an inside interface at security lever 99 which is able to access that service.
Also, i have defined the following command to allow same security level communication.
same-security-traffic permit inter-interface
Cisco Firewall :: 3.2 (18) - URL Filtering In FWSM Without External Server
May 18, 2011I have an FWSM running in multiple context mode running 3.2(18) code. I have 3 urls that I would like to block so I can't justify the cost of an external URL filtering server. I have found a way to filter individual URLs on the ASA but the same configuration does not seem to be available on the FWSM. At least not on my code. Any way to do this other than resolving the hostnames and blocking the current IP addresses?
View 1 Replies View RelatedCisco Firewall :: 7604 FWSM Boot Failure
Dec 20, 2012I have 7604 router with FWSM module in module 3.First of all the FWSM CF has been damaged, not physically. I bought the new same compact flash (size, partnumber, etc.). Downloaded the software 3.2 for FWSM, and ASDM from Cisco website. I realized that the procedure of creating new CF for FWSM is quite diffucult: creating 1-5 partitions, where 1 - is MP, and 4th - application partition. According to cisco documentation - the default boot partition is the 4th, so I partitioned from 7604 the CF into 4 partitions (partition disk1: <1-4> maximum) and copied the software and ASDM to the 4th partition (disk1:3:). Removed the CF from the router and put it into the FWSM module.
View 1 Replies View RelatedCisco Firewall :: Recommended Code For ASA5580 / ACE And FWSM?
Mar 24, 2011We are in the process of building a new DC and would like to know which is the recommended version of code to run on the following:
Firewall Services Module
Cisco ASA5580, 5550, 5520
ACE module