Cisco Smart Switches Configuration Guide for DPU Security Mode, Release 10.6(x)

Enable service firewall

Updated: August 23, 2026

Want to summarize with AI?

Provides instructions to enable traffic inspection with in-service command that enables service firewall.

The in-service command enables the service firewall functionality, and allows traffic inspection by the DPUs.

You can also use the no in-service command to trigger maintenance mode for the firewall functionality and, to disable traffic redirection to DPUs for any reason or modify the load-balance mode.

Procedure

Use the in-service command to enable the service firewall to redirect specific traffic.

Example:

switch(config-svc-sys-fw)# in-service

Verify the service firewall and redirection status

You can verify the status of the service firewall and redirection when the status is out-of-service or in-service. This section provides examples for both the statuses.

Use the show service-acceleration status details command to view the firewall service when is in out-of-service state.

switch# show service-acceleration status details
Service System: hypershield
   Source Interface: loopback48 (10.1.1.1) 
   DPU Load-balance Mode: symmetric-hash 
   Agent Status: firewall-disable
   Agent Health Status: ok 
   Controller Connection Status: init 
   Agent HA Status: not-initialized 
   Services:
     Firewall: out-of-service

VRF             Operational State       Affinity(DPU)
======================================================================
blue            isolated                n/a
red             isolated                n/a

VLAN            Operational State       Affinity(DPU)
======================================================================
100             VLAN set to drop        n/a
200             VLAN set to drop        n/a

Use the show service-acceleration status details command to view the status of the firewall service when it is in in-service state.

This example shows the firewall service in the in-service state and in pinning mode.

switch# show service-acceleration status details 
  Service System: hypershield
    Source Interface: loopback48 (10.1.1.1) 
    DPU Load-balance Mode: pinning
    Agent Status: firewall-ready,redirect-installed 
    Agent Health Status: ok
    Controller Connection Status: success 
    Agent HA Status: not-initialized Services:
      Firewall: in-service

      VRF                              Operational State       Affinity(DPU)
      ======================================================================
      blue                             forwarding ready        1        
      red                              forwarding ready        2       

      VLAN                             Operational State       Affinity(DPU)
      ======================================================================
      100                              forwarding ready        1        
      200                              forwarding ready        2

This example shows the firewall service in the in-service state and in symmetric-hash mode.

show service-acceleration status details 
  Service System: hypershield 
    Source Interface: loopback48 (10.1.1.1) 
    DPU Load-balance Mode: symmetric-hash 
    Agent Status: firewall-ready,redirect-installed 
    Agent Health Status: ok 
    Controller Connection Status: success 
    Agent HA Status: not-initialized 
    Services: 
      Firewall: in-service 
  
      VRF                              Operational State       Affinity(DPU)
      ======================================================================
      blue                             forwarding ready        1-4        
      red                              forwarding ready        1-4        

      VLAN                             Operational State       Affinity(DPU)
      ======================================================================
      100                              forwarding ready        1-4        
      200                              forwarding ready        1-4

Use the command show service-acceleration redirect-policy brief to identify the service port-channel subinterfaces for redirecting traffic from the VRFs or VLANs to the DPUs.

This example shows the output when symmetric-hash load-balance mode is in use.

switch# show service-acceleration redirect-policy brief 

VRF                              AF Type Interface[Status]    Affinity   Redirect Status 
=========================================================================================
red                              IPv4    Spo512.10[UP]        1-4        Enabled         
blue                             IPv4    Spo512.11[UP]        1-4        Enabled         
red                              IPv6    Spo512.10[UP]        1-4        Enabled         
blue                             IPv6    Spo512.11[UP]        1-4        Enabled         

VLAN                             AF Type Interface[Status]    Affinity   Redirect Status 
=========================================================================================
100                              IPv4    Spo512[UP]           1-4        Enabled         
200                              IPv4    Spo512[UP]           1-4        Enabled        
100                              IPv4    Spo512[UP]           1-4        Enabled         
200                              IPv4    Spo512[UP]           1-4        Enabled

This example shows the output when pinning load-balance mode is in use.

switch# show service-acceleration redirect-policy brief
 
VRF                              AF Type Interface[Status]    Affinity   Redirect Status 
=========================================================================================
red                              IPv4    Spo2.10[UP]        1-4        Enabled         
blue                             IPv4    Spo1.11[UP]        1-4        Enabled         
red                              IPv6    Spo2.10[UP]        1-4        Enabled         
blue                             IPv6    Spo1.11[UP]        1-4        Enabled         

VLAN                             AF Type Interface[Status]    Affinity   Redirect Status 
=========================================================================================
100                              IPv4    Spo1[UP]           1-4        Enabled         
200                              IPv4    Spo2[UP]           1-4        Enabled        
100                              IPv4    Spo1[UP]           1-4        Enabled         
200                              IPv4    Spo2[UP]           1-4        Enabled

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.