Re: FWSM newbie - traffic bypassed firewall

looks to me like the :
ip address inside 192.168.5.1 255.255.255.0

Ip address exsits two places - once in C6500-SVI and once in FWSM-context.
.....
btw your ACL in that context denys all ...

HTH
Martin Bilgrav


"wookie" <wookie_at_blue_dot_uta_dot_edu@xxxxxxx> wrote in message
news:BBTAk.764$F_4.291@xxxxxxxxxxxxxxxxxxxxxxxxxx
Hi all,
I am new with FWSM. I am try to implement with routed mode in multiple
context. Currently the traffic seems totally bypased the firewall, what am
I missing here. Thanks in advance. Here is the basic design.


6506 MSFC
| 192.168.2.1
|
|
|dot1q trunk
|
|
|
6509 MSFC
|
| 192.168.2.2 vlan2
|--------------------+ outside
| |
|192.168.2.3 | 192.168.2.4
context Context
admin A
| | 192.168.5.1
| | vlan5
| | inside


6506, vtp mode server
6509, vtp mode client, FWSM (version 2.3.5)

MSFC in front of FWSM, routed mode, multiple context, inside and outside
using real IP NO Nated.

6506 contain 3 vlan (vlan 2,3,4), vtp mode server, vtp domain xxx
int vlan2
ip address 192.168.2.1 255.255.255.0
int vlan3
ip address 192.168.3.1 255.255.255.0
int vlan4
ip address 192.168.4.1 255.255.255.0
ip route 192.168.5.1 255.255.255.0 192.168.2.2




6509 contain 3 vlan (vlan 2,5,6)
int vlan2
ip address 192.168.2.2 255.255.255.0
int vlan5
ip address 192.168.5.1 255.255.255.0
ip address 192.168.55.1 255.255.255.0 secondary
int vlan6
ip address 192.168.6.1 255.255.255.0

firewall multiple-vlan-interfaces
firewall module 4 vlan-group 1
firewall vlan-group 1 2,5,6
ip route 0.0.0.0 0.0.0.0 192.168.2.1


FWSM
admin-context admin
context admin
allocate-interface vlan2
allocate-interface vlan6
config-url disk:/admin.cfg
!

context A
allocate-interface vlan2
allocate-interface vlan5
config-url disk:/contextA.cfg



FWSM configuration for context A
nameif vlan2 outside security0
nameif vlan5 inside security100
ip address outside 192.168.2.4 255.255.255.0
ip address inside 192.168.5.1 255.255.255.0
icmp permit any outside
icmp permit any inside
access-list outbound extended permit ip any any
access-list 101 extended deny ip any any
nat (inside) 0 access-list outbound
access-group 101 in int outside
route outside 0.0.0.0 0.0.0.0 129.107.254.2 1


--





##-----------------------------------------------##
Telecom Discussions at
http://www.telecom-gear.com/
no-spam access to your favorite newsgroup -
comp.dcom.sys.cisco - 47339 messages and counting!
##-----------------------------------------------##



.

Relevant Pages