Considerations for vswitch Firewall Configuration Management

Precautions for vswitch Firewall Configuration Management: 6509 vswitch FWSM firewall transparent mode configuration. A friend asked me to solve the problem of switch firewall configuration and asked many people for a satisfactory response. Below is a similar answer to the question found on the Internet.

Transparent firewall Mode

Feature description: The firewall supports a transparent firewall mode starting from PIX 7.0 and FWSM 2.2. The interface does not need to configure the address information and works on the second layer. Only two interfaces inside and outside are supported. Of course, one management interface can be configured, but the management interface cannot be used to process user traffic. physical ports cannot be reused in Multi-context mode.

Because the network is connected to the same IP address segment, NAT is not supported. Although there is no IP address, you can configure an ACL to check traffic. Configure Firewall (config) # firewall transparent (show firewall) to verify the current working mode. Because the routing mode and transparent mode work in different ways, so the current configuration file will be cleared when switching between them ).

Firewall Configuration interface Firewall (config) # interface hardware-id
Firewall (config-if) # speed {auto | 10 | 100 | nonegotiate}
Firewall (config-if) # duplex {auto | full | half}
Firewall (config-if) # [no] shutdown
Firewall (config-if) # nameif if_name
Firewall (config-if) # security-level

Switch firewall configuration Note: you do not need to configure IP address information, but you still need to configure other properties. The interface security level is generally different,

The same-security-traffic permit inter-interface command can remove this restriction.
Configuration Management address Firewall (config) # ip address ip_address subnet_mask
Firewall (config) # route if_name foreign_network foreign_mask gateway [metric]
Configure the MAC address table Firewall # show mac-address-table to display the MAC address table
Firewall (config) # mac-address-table aging-time minutes set MAC address table expiration time
Firewall (config) # mac-address-table static if_name mac_address set static MAC entries
Firewall (config) # mac-learn if_name disable specific interface address learning (show mac-learn verification)
ARP check Firewall (config) # arp if_name ip_address mac_address static ARP entry
Firewall (config) # arp-inspection if_name enable [flood | no-flood]

Switch Firewall Configuration Port enable ARP check non-IP Protocol Configuration forwarding policy Firewall (config) # access-list acl_id ethertype {permit | deny} {any | bpdu | ipx | mpls-unicast | mpls-multicast | ethertype}
Firewall (config) # access-group acl_id {in | out} interface if_name.