Feedback
Table Of Contents
Understanding How the Firewall Services Module Works
Multiple Firewall Services Module Configuration
Specifications and System Limitations
Overview
This chapter describes the Catalyst 6500 Series Firewall Services Module, how it operates, and how to manage it. This chapter contains these sections:
•
Understanding How the Firewall Services Module Works
•
Before You Begin
To help you get started using the Firewall Services Module, refer to this roadmap:
Note
Table A-1 lists the PIX commands used by the module.
Table A-2 lists the Cisco IOS commands for the module.
Table A-4 lists the new commands specific to the module. These commands are described in Appendix B, "Command Reference."
Table A-5 lists the PIX commands that were changed for the module.
Table A-6 lists the PIX commands that are not used by the module.
Table A-7 lists the PIX commands used by the module and their PIX version.
Understanding How the Firewall Services Module Works
Firewalls protect an internal (inside) network, such as a data center, from unauthorized access by users on an external (outside) network, such as the public Internet.
Note
You also can protect one or more networks, known as demilitarized zones (DMZs). DMZs are those portions of the network that contain resources that you may want to allow access to for specified users. Access to a DMZ is usually more restricted than access to the outside network, but less restricted than access to the inside network.
A DMZ allows you to protect your network resources that need to be accessed by users on the public Internet, for example, mail servers or web servers. By placing them in a DMZ, you obtain some protection without jeopardizing the resources on your internal network.
Connections between the inside and outside and DMZ networks are controlled by the module through the firewall using a network-modeled protection scheme based upon a configuration and security policy. By implementing a security policy, you can ensure that all traffic from the protected networks only passes through the firewall to the unprotected network. You also can control who accesses the networks and with which services. Features on the module allow you to control how your security policy is used.
The security policy determines the security level, which allows you to isolate networks that are assigned the same security level from each other. To route traffic between different networks, you assign each network a different security level. A lower security level provides less protection for the interface than a higher security level. The security levels to your networks can range from 0 to 100.
All interfaces connecting the inside, outside, and DMZ networks through the module are virtual and logical Layer 3 interfaces consisting of a VLAN, an IP address, and a security level. The module supports 100 firewall interfaces. All traffic between these VLANs is protected and controlled. Because the module supports multiple interfaces, you can create one or more DMZ networks.
The Firewall Services Module is a fabric-enabled module that connects to both the Catalyst 6500 bus and the Switch Fabric Module if one is present. A Switch Fabric Module is not required for the Firewall Services Module to function.
The module has a 6-Gbps dot1q EtherChannel connection to the backplane where the hosts of the various security zones are connected to ports on the Catalyst 6500 chassis.
The module can be configured in a multiple, failover, or redundant configuration.
Figure 1-1 shows a firewall configuration. The Multilayer Switch Feature Card (MSFC) is used as a router on the network inside the firewall. The MSFC is connected to only one of the controlled firewall interfaces. All other router interfaces configured on the MSFC are considered to be the same security level as the interface to which the MSFC is connected. For example, traffic between VLAN 201 and VLAN 202 is routed directly.
Figure 1-1 Firewall Services Module Configuration
These sections describe firewall configuration and failover:
•
Multiple Firewall Services Module Configuration
Figure 1-2 shows multiple modules that are located in the same switch, and how they can operate independently. You can have up to four FWSMs installed in the same switch. The network requirements and topology determine the configuration.
Figure 1-2 Multiple Firewall Services Module Configuration
In a multiple-module configuration, the following conditions apply:
•
•
•
Redundancy Failover
The failover configuration has these features:
•
Note
•
•
•
The module can be configured to use stateful failover as shown in Figure 1-3. Stateful failover allows you to maintain the operating state for the connection during the failover from the primary module to the standby module.
Figure 1-3 Stateful Failover Configuration
When a failover occurs, each module changes its state. The new active module begins accepting traffic. The new standby module assumes the failover IP and MAC addresses of the module that was previously the active module. Because network devices do not detect a change in these addresses, there are no ARP entries changed nor is there a time out anywhere on the network.
Be sure that both modules have the same software version, VLAN configuration, Flash memory, and RAM; if not, the configuration copied to the standby module will not work. After you configure the primary module and provide the failover link, the primary module automatically copies the configuration over to the standby module.
Note
Figure 1-4 shows two modules located in separate chassis: one module is designated as the active module and the other module is designated as the standby module.
Figure 1-4 Multiple-Module Configuration in a Network
In this multiple-module configuration, the following conditions apply:
•
•
•
•
Feature Set
The Firewall Services Module (FWSM) is a high performance firewall used on the Catalyst 6500 series switch and Cisco 7600 series router. The FWSM can occupy a single slot in the Catalyst 6500 series and Cisco 7600 series chassis or two slots in a redundant configuration. Two modules can also reside in separate chassis in a failover configuration.
The Firewall Services Module provides the following features:
•
•
•
•
•
•
•
•
•
•
Note
•
•
The stateful, connection-oriented ASA creates session flows based on source and destination addresses, TCP sequence numbers (which are non-predictable), port numbers, and additional TCP flags. You can control all inbound and outbound traffic by applying security policies to each connection table entry.
•
•
•
•
–
–
When the Firewall Services Module software is the platform, PDM will display modified screens for features not supported by the module. To use the PDM to configure the module, refer to the Cisco PIX Device Manager Installation Guide, Version 2.1.
The following PIX firewall features are not supported by the module:
•
•
•
•
•
Specifications and System Limitations
Table 1 lists the specifications and system limitations of the FWSM.
Table 1 FWSM Specifications and System Limitations
Modules per switch
Maximum of four modules per switch.
If you are using failover, you can still only have four modules per switch even if two of them are in standby mode.
Memory
•
•
Bandwidth
CEF256 line card with a 6-Gbps path to the Switch Fabric Module (if present) or the 32-Gbps shared bus.
Filtering servers
16 Websense Enterprise filtering servers.
IPSec management connections, concurrent
5 connections.
TCP1 or UDP2 connections between any two hosts, including connections between one host and multiple other hosts, concurrent and rate
999,900 connections.
100K connections per second.
Fixup connections, rate
10,000 per second.
PC based fixup connections, rate
10K per second.
Host connections, concurrent
256K
SSH3 management connections, concurrent
5 connections.
System messages, rate
20K per second.
Telnet management connections, concurrent
5 connections.
NAT translations, concurrent
256K.
NAT statements
1K statements.
High-performance firewall
5 GBps (aggregated).
Concurrent connections.
1 million
Packets-per-second.
3 million pps
New connections per second for HTTP, DNS, and enhanced Simple Mail Transfer Protocol (SMTP).
7K
VLAN interfaces (no physical interfaces on the module).
100
Static NAT statements
1K statements.
Global statements
1K statements.
Shun statements
2K statements. The FWSM supports at most 2000 shuns - that number is contigent upon finite hardware resources and cannot be increased.
Alias statements
1K statements.
User authentication sessions, concurrent
5K sessions.
User authorization sessions, concurrent
150K sessions.
Maximum 15 sessions per user.
ARP4 table entries, concurrent
64K entries.
Route table entries, concurrent
32K entries.
Packet reassembly, concurrent
30,000 fragments.
Filter Rules, Fixup and Filter statements combined.
3K rules and statements.
Established CLI Rules
1K rules.
Established data
1K implicit rules used by TCP and UDP fixups to allow back channels.
3K statements.
AAA Rules
3K rules. 1K rules for authentication, 1K rules for authorization, and 1K rules for accounting.
1K rules.
ACEs
72K ACEs (best case).
1 Transmission Control Protocol
2 User Datagram Protocol
3 Secure Shell
4 Address Resolution Protocol
5 Internet Control Message Protocol
6 HyperText Transfer Protocol
Front Panel Description
The front panel includes a STATUS LED and SHUTDOWN button. (See Figure 1-5)
Figure 1-5 Firewall Services Module Front Panel
These sections describe the front panel components:
STATUS LED
The STATUS LED indicates the operating states of the module. Table 1-2 describes the LED operation.
SHUTDOWN Button
Caution
To avoid corrupting the compact Flash memory, you must correctly shut down the module before you remove it from the chassis or disconnect the power. This shutdown procedure is initiated normally by commands entered at the supervisor engine CLI prompt or the module CLI prompt.
If the module fails to respond to these commands properly, you must use the SHUTDOWN button on the front panel to initiate the shutdown procedure. Use a small pointed object (such as a paper clip) to push the button.
The shutdown procedure may require several minutes. The STATUS LED turns orange when the module shuts down.
Hardware Specifications
Table 1-3 describes the specifications for the module.
