Cisco 7604 Configuration Guide - Page 49

Chapter 2 Configuring the Switch for the Firewall Services Module Assigning VLANs to the Firewall Services Module This section includes the following topics: • VLAN Guidelines, page 2-3 • Assigning VLANs to the FWSM, page 2-3 VLAN Guidelines See the following guidelines for using VLANs with the FWSM: • You can use private VLANs with the FWSM. Assign the primary VLAN to the FWSM; the FWSM automatically handles secondary VLAN traffic. • You cannot use reserved VLANs. • You cannot use VLAN 1. • If you are using FWSM failover within the same switch chassis, do not assign the VLAN(s) you are reserving for failover and stateful communications to a switch port. However, if you are using failover between chassis, you must include the VLANs in the trunk port between the chassis. • If you do not add the VLANs to the switch before you assign them to the FWSM, the VLANs are stored in the supervisor engine database and are sent to the FWSM as soon as they are added to the switch. Assigning VLANs to the FWSM In Cisco IOS software, create up to 16 firewall VLAN groups, and then assign the groups to the FWSM. For example, you can assign all the VLANs to one group, or you can create an inside group and an outside group, or you can create a group for each customer. Each group can contain unlimited VLANs. You cannot assign the same VLAN to multiple firewall groups; however, you can assign multiple firewall groups to an FWSM and you can assign a single firewall group to multiple FWSMs. VLANs that you want to assign to multiple FWSMs, for example, can reside in a separate group from VLANs that are unique to each FWSM. To assign VLANs to the FWSM, perform the following steps: Step 1 To assign VLANs to a firewall group, enter the following command: Router(config)# firewall vlan-group firewall_group vlan_range The firewall_group argument is an integer. The vlan_range can be one or more VLANs (2 to 1000 and from 1025 to 4094) identified in one of the following ways: • A single number (n) • A range (n-x) Separate numbers or ranges by commas. For example, enter the following numbers: 5,7-10,13,45-100 Note Routed ports and WAN ports consume internal VLANs, so it is possible that VLANs in the 1020-1100 range might already be in use. OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 2-3