Table Of Contents
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Installation Note
Memory and Hardware Requirements
Memory and Storage Requirements
Installing and Removing the FWSM
Verifying the Installation and Configuring the Module
Statement 200—Safety Information Referral Warning
Statement 94—Wrist Strap Warning
Statement 1030—Equipment Installation
Statement 1034—Backplane Voltage
Statement 1029—Blank Faceplates and Cover Panels
Statement 1051—Laser Radiation
Obtaining Technical Assistance
Cisco Technical Support Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Installation Note
Product number: WS-SVC-FWM-1-K9
This publication describes how to install the Firewall Services Module (FWSM) in the Catalyst 6500 series switch chassis and Cisco 7600 series router chassis, and it includes the FWSM hardware requirements.
Note
The Catalyst 6500 series consists of the Catalyst 6500 and Catalyst 6000 series switches. The Catalyst 6500 series consists of the Catalyst 6006, 6009, 6503, 6506, 6509, 6509-NEB, 6509-NEB-A, and 6513 switches. Throughout this publication and all Catalyst 6500 documents, the phrase "Catalyst 6500 switches" refers to these switches, unless otherwise noted.
Note
For information on the latest caveats and for updates on the FWSM, refer to this publication: Release Notes for the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module.
Contents
This publication consists of these sections:
•
Memory and Hardware Requirements
•
Installing and Removing the FWSM
•
Obtaining Technical Assistance
•
Obtaining Additional Publications and Information
Product Overview
The FWSM is a high-performance firewall module for the Catalyst 6500 series switches and the Cisco 7600 series routers. The FWSM protects inside networks from unauthorized access by users on an outside network. It can also protect inside networks from each other, for example, by keeping a human resources network separate from a user network. If you have network resources that need to be available to an outside user, such as a web server or an FTP server, you can place these resources on a separate network behind the firewall, called a demilitarized zone (DMZ). The firewall allows limited access to the DMZ, but because the DMZ includes the public servers only, an attack on the DMZ affects only the servers and does not affect the other inside networks. You can also control outside access by inside users (for example, access to the Internet) by allowing only certain addresses out, by requiring authentication or authorization, or by coordinating with an external URL filtering server.
The FWSM includes advanced features, such as multiple security contexts (which are virtualized), transparent (Layer 2) firewall or routed (Layer 3) firewall operations, hundreds of interfaces, and many other features. For more information, refer to the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Software Configuration Guide.
Safety Overview
Safety warnings appear throughout this publication in procedures that may harm you if performed incorrectly. A warning symbol precedes each warning statement.
Physical Description
This section describes the physical attributes of the Firewall Services Module:
Front Panel Description
The front panel includes a STATUS LED and SHUTDOWN button. (See Figure 1.)
Figure 1 Firewall Services Module Front Panel
STATUS LED
The STATUS LED indicates the operating states of the module. Table 1 describes the LED operation.
SHUTDOWN Button
CautionDo not remove the module from the switch until the module has shut down completely and the STATUS LED is orange or off. You can damage the module if you remove it from the switch before it completely shuts down.
To avoid corrupting the compact Flash memory, you must correctly shut down the module before you remove it from the chassis or disconnect the power. The shutdown procedure is initiated by commands entered at the supervisor engine CLI prompt or the module CLI prompt.
If the module fails to properly respond to these commands, use the SHUTDOWN button on the front panel to initiate the shutdown procedure.
The shutdown procedure may require several minutes. The STATUS LED turns orange when the module shuts down.
Hardware Specifications
Table 2 describes the hardware specifications for the FWSM.
Memory and Hardware Requirements
This section describes the memory and hardware requirements for the FWSM:
•
Memory and Storage Requirements
Memory and Storage Requirements
The switch does not require additional memory or storage for the FWSM. The module contains the following memory:
•
1 GB RAM
•
128 MB compact Flash
Hardware Requirements
The Cisco IOS software and Catalyst operating system software require a Catalyst 6500 series switch or Cisco 7600 series router with a Supervisor Engine 1A (Catalyst operating system only) and an MSFC 2 or a Supervisor Engine 2 (Catalyst operating system and Cisco IOS) and an MSFC 2. The FWSM is supported on the supervisor engine with Cisco IOS software and the Catalyst operating system software.
Note
Before installing the FWSM, you must install the Catalyst 6500 series switch or Cisco 7600 series router chassis and at least one supervisor engine. For information on installing the chassis, refer to the Catalyst 6500 Series Installation Guide or the Cisco 7600 Series Router Installation Guide.
Required Tools
These tools are required to install the FWSM in the Catalyst 6500 series switches and Cisco 7600 series routers:
•
Flat-blade screwdriver
•
Phillips-head screwdriver
•
Wrist strap or other grounding device
•
Antistatic mat or antistatic foam
Whenever you handle the module, always use a wrist strap or other grounding device to prevent electrostatic discharge (ESD).
Installing and Removing the FWSM
Warning
Only trained and qualified personnel should be allowed to install, replace, or service this equipment. Statement 1030
Warning
During this procedure, wear grounding wrist straps to avoid ESD damage to the module. Do not directly touch the backplane with your hand or any metal tool, or you could shock yourself. Statement 94
All Catalyst 6500 series switches and Cisco 7600 series routers support hot swapping, which allows you to install, remove, replace, and rearrange modules without turning off the system power. For more information on removing the FWSM from a switch, see the "Removing a Module" section.
When the system software detects that a module has been installed or removed, the system automatically runs diagnostic and discovery routines, acknowledges the presence or absence of the module, and resumes system operation.
This section describes how to install and verify the operation of the FWSM in the Catalyst 6500 series switches and Cisco 7600 series routers, and it contains the following sections:
•
Verifying the Installation and Configuring the Module
Slot Assignments
The Catalyst 6503 switch chassis has three horizontal slots, the Catalyst 6006 and 6506 switch chassis have six horizontal slots, the Catalyst 6009 and 6509 switch chassis have nine horizontal slots, and the Catalyst 6513 switch chassis has thirteen horizontal slots.
The Catalyst 6509-NEB and Catalyst 6509-NEB-A switches have nine vertical slots, which are numbered 1 to 9 from right to left. Install the modules with the component side facing to the right.
For the 3-, 6-, and 9-slot chassis, each slot is used as follows:
•
Slot 1 is reserved for the supervisor engine.
•
Slot 2 can be used for a redundant supervisor engine if the supervisor engine in slot 1 fails.
•
If a redundant supervisor engine is not required, slot 3 on the 3-slot chassis, slots 2 through 6 on the 6-slot chassis, and slots 2 through 9 on the 9-slot chassis are available for switching modules, such as the Firewall Services Module.
•
The empty slots require filler plates, which are blank switching-module carriers, to maintain consistent airflow through the switch chassis.
For the 13-slot chassis, each slot is used as follows:
•
Slot 1 is reserved for the supervisor engine if you are using a Supervisor Engine 2.
•
Slot 2 can be used for a redundant supervisor engine if the Supervisor Engine 2 in slot 1 fails.
•
Slots 7 and 8 are reserved for supervisor engines if you are using the Supervisor Engine 32 or the Supervisor Engine 720.
•
If a redundant supervisor engine is not required, all of the remaining slots are available for switching modules, such as the Firewall Services Module.
•
The empty slots require filler plates, which are blank switching-module carriers, to maintain consistent airflow through the switch chassis.
Removing a Module
This section describes how to remove an existing supervisor engine module from a chassis slot.
Warning
During this procedure, wear grounding wrist straps to avoid ESD damage to the module. Do not directly touch the backplane with your hand or any metal tool, or you could shock yourself. Statement 94
Warning
Before you install, operate, or service the system, read the Site Preparation and Safety Guide. This guide contains important safety information you should know before working with the system. Statement 200
Warning
Invisible laser radiation may be emitted from disconnected fibers or connectors. Do not stare into beams or view directly with optical instruments. Statement 1051
Warning
Hazardous voltage or energy is present on the backplane when the system is operating. Use caution when servicing. Statement 1034
To remove a supervisor engine or module from the chassis slot, perform these steps:
Step 1
Disconnect any network interface cables attached to the supervisor engine or module.
Step 2
Verify that the captive installation screws on all modules in the chassis are tight.
This step ensures that the space created by the removed module is maintained.
Note
If the captive installation screws are loose, the electromagnetic interference (EMI) gaskets on the installed modules will push the modules toward the open slot, reducing the opening size and making it difficult to install the replacement module.
Step 3
Loosen the two captive installation screws on the supervisor engine or module.
Step 4
Depending on the orientation of the slots in the chassis (horizontal or vertical), perform one of the following sets of substeps:
Horizontal slots
a.
Place your thumbs on the left and right ejector levers, and simultaneously rotate the levers outward to unseat the module from the backplane connector.
b.
Grasp the front edge of the module, and slide the module part of the way out of the slot. Place one hand under the module to support the weight of the module. Do not touch the module circuitry.
Vertical slots
a.
Place your thumbs on the ejector levers located at the top and bottom of the module, and simultaneously rotate the levers outward to unseat the module from the backplane connector.
b.
Grasp the edges of the module, and slide the module straight out of the slot. Do not touch the module circuitry.
Step 5
Place the module on an antistatic mat or antistatic foam, or immediately reinstall it in another slot.
Step 6
If the slot is to remain empty, install a module filler plate to keep dust out of the chassis and to maintain proper airflow through the chassis.
Warning
Blank faceplates (filler panels) serve three important functions: they prevent exposure to hazardous voltages and currents inside the chassis; they contain electromagnetic interference (EMI) that might disrupt other equipment; and they direct the flow of cooling air through the chassis. Do not operate the system unless all modules and faceplates are in place. Statement 1029
Installing a Module
This section describes how to install modules in the Catalyst 6500 series switches.
CautionTo prevent ESD damage, handle modules by the carrier edges only.
Warning
During this procedure, wear grounding wrist straps to avoid ESD damage to the module. Do not directly touch the backplane with your hand or any metal tool, or you could shock yourself. Statement 94
Warning
Invisible laser radiation may be emitted from disconnected fibers or connectors. Do not stare into beams or view directly with optical instruments. Statement 1051
Warning
Before you install, operate, or service the system, read the Site Preparation and Safety Guide. This guide contains important safety information you should know before working with the system. Statement 200
To install a supervisor engine or module in the chassis, perform these steps:
Step 1
Choose a slot for the supervisor engine or module.
Step 2
Verify that there is enough clearance to accommodate any interface equipment that you will connect directly to the supervisor engine or module ports. If possible, place modules between empty slots that contain only module filler plates.
Step 3
Verify that the captive installation screws are tightened on all modules installed in the chassis.
This action ensures that the EMI gaskets on all modules are fully compressed to maximize the opening space for the new module or the replacement module.
Note
If the captive installation screws are loose, the EMI gaskets on the installed modules will push adjacent modules toward the open slot, reducing the opening size and making it difficult to install the replacement module.
Step 4
Remove the module filler plate by removing the two Phillips pan-head screws from the filler plate. To remove a module, see the "Removing a Module" section.
Step 5
Fully open both ejector levers on the new or replacement module. (See Figure 2.)
Figure 2 Positioning the Module in a Horizontal Slot Chassis
Step 6
Depending on the orientation of the slots in the chassis (horizontal or vertical), perform one of the following sets of substeps:
Horizontal slots
a.
Position the supervisor engine or module in the slot. (See Figure 2.) Make sure that you align the sides of the module carrier with the slot guides on each side of the slot.
b.
Carefully slide the supervisor engine or module into the slot until the EMI gasket along the top edge of the module makes contact with the module in the slot above it and both ejector levers have closed to approximately 45 degrees with respect to the module faceplate. (See Figure 3.)
Figure 3 Clearing the EMI Gasket in a Horizontal Slot Chassis
c.
Using the thumb and forefinger of each hand, grasp the two ejector levers, and press down to create a small (0.040 inch [1 mm]) gap between the EMI gasket and the module above it. (See Figure 3.)
CautionDo not press down too hard on the levers. They will bend and be damaged.
d.
While pressing down, simultaneously close the left and right ejector levers to fully seat the supervisor engine or module in the backplane connector. The ejector levers are fully closed when they are flush with the module faceplate. (See Figure 4.)
Figure 4 Ejector Lever Closure in a Horizontal Slot Chassis
Note
Failure to fully seat the module in the backplane connector can result in error messages.
e.
Tighten the two captive installation screws on the supervisor engine or module.
Note
Make sure the ejector levers are fully closed before tightening the captive installation screws.
Vertical slots
a.
Position the supervisor engine or switching module in the slot. (See Figure 5.) Make sure that you align the sides of the switching-module carrier with the slot guides on the top and bottom of the slot.
Figure 5 Positioning the Module in a Vertical Slot Chassis
b.
Carefully slide the supervisor engine or module into the slot until the EMI gasket along the right edge of the module makes contact with the module in the slot adjacent to it and both ejector levers have closed to approximately 45 degrees in relation to the faceplate. (See Figure 6.)
c.
Using the thumb and forefinger of each hand, grasp the two ejector levers, and exert a slight pressure to the left, deflecting the module approximately 0.040 inches (1 mm) to create a small gap between the EMI gasket and the module adjacent to it. (See Figure 6.)
Figure 6 Clearing the EMI Gasket in a Vertical Slot Chassis
CautionDo not exert too much pressure on the ejector levers. They will bend and be damaged.
d.
While pressing on the ejector levers, simultaneously close them to fully seat the supervisor engine or module in the backplane connector. The ejector levers are fully closed when they are flush with the module faceplate. (See Figure 7.)
Figure 7 Ejector Lever Closure in a Vertical Slot Chassis
e.
Tighten the two captive installation screws on the module.
Note
Make sure the ejector levers are fully closed before tightening the captive installation screws.
Verifying the Installation and Configuring the Module
You can verify installation and configure the module using both Cisco IOS software and the Catalyst operating system software. Refer to the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide for details.
Translated Safety Warnings
This section repeats in multiple languages the basic warnings that appear in this publication.
Statement 200—Safety Information Referral Warning
Statement 94—Wrist Strap Warning
Statement 1030—Equipment Installation
Statement 1034—Backplane Voltage
Statement 1029—Blank Faceplates and Cover Panels
Statement 1051—Laser Radiation
Related Documentation
Use this document in conjunction with the following Cisco documents:
•
Catalyst 6500 Series Cisco IOS Software Configuration Guide
•
Catalyst 6500 Series Software Configuration Guide
•
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference
•
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Software Configuration Guide
•
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module System Messages Guide
•
Release Notes for the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
You can order Cisco documentation in these ways:
•
Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:
http://www.cisco.com/en/US/partner/ordering/index.shtml
•
Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).
Documentation Feedback
You can send comments about technical documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.
Cisco Technical Support Website
The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool automatically provides recommended solutions. If your issue is not resolved using the recommended resources, your service request will be assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553 2447For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:
http://www.cisco.com/go/marketplace/
•
The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:
http://cisco.com/univercd/cc/td/doc/pcat/
•
Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:
•
Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources. You can access Packet magazine at this URL:
•
iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies learn how they can use technology to increase revenue, streamline their business, and expand services. The publication identifies the challenges facing these companies and the technologies to help solve them, using real-world case studies and business strategies to help readers make sound technology investment decisions. You can access iQ Magazine at this URL:
http://www.cisco.com/go/iqmagazine
•
Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:
•
World-class networking training is available from Cisco. You can view current offerings at this URL:
http://www.cisco.com/en/US/learning/index.html
This document is to be used in conjunction with the Catalyst 6500 Series Switch Module Installation Guide.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0402R)
Copyright © 2004 Cisco Systems, Inc. All rights reserved.


















































































