Cisco 7604 Configuration Guide - Page 43

Chapter 1 Introduction to the Firewall Services Module Firewall Mode Overview For multiple context mode, if you place the MSFC behind the FWSM, you should only connect it to a single context. If you connect the MSFC to multiple contexts, the MSFC will route between the contexts, which might not be your intention. The typical scenario for multiple contexts is to use the MSFC in front of all the contexts to route between the Internet and the switched networks (see Figure 1-2). Figure 1-2 MSFC Placement with Multiple Contexts Internet Admin Context Context A VLAN 100 MSFC VLAN 200 Context B Context C VLAN 201 VLAN 202 VLAN 203 VLAN 204 Admin Network Inside Customer A Inside Customer B Inside Customer C 92882 Firewall Mode Overview The FWSM runs in two different firewall modes: • Routed • Transparent In routed mode, the FWSM is considered to be a router hop in the network. In transparent mode, the FWSM acts like a "bump in the wire," or a "stealth firewall," and is not considered a router hop. The FWSM connects to the same network on its inside and outside interfaces. You can configure up to eight pairs of interfaces (called bridge groups) to connect to eight different networks, per context. You might use a transparent firewall to simplify your network configuration. Transparent mode is also useful if you want the firewall to be invisible to attackers. You can also use a transparent firewall for traffic that would otherwise be blocked in routed mode. For example, a transparent firewall can allow unsupported routing protocols. In multiple context mode, you can choose the mode for each context independently, so some contexts can run in transparent mode while others can run in routed mode. OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 1-7