Foundation and Supplemental TopicsCisco Firewall Services Module OverviewThe Cisco Firewall Services Module (FWSM) is a high-performance firewall solution, providing 5 gigabits per second (Gbps) of throughput from a single FWSM. Combining multiple modules in a single chassis enables you to scale this throughput to 20 Gbps. Some features of the FWSM include the following:
Initially, the FWSM provided several features that were not available with the PIX software. These included features such as Open Shortest Path First (OSPF) functionality and support for VLAN tagging. As of PIX Firewall Version 6.3, many of these features have been incorporated into the PIX software. Chapter 9, "Routing and the PIX Firewall."Because the FWSM command set is derived from the PIX 6.0 feature set, many of the configuration tasks that you use to configure the FWSM are similar if not identical to the PIX configuration tasks. Therefore, this chapter focuses on the following aspects of the FWSM:
Basic Deployment ScenariosFigure 19-1 shows a basic network configuration in which a central switch is used to connect various VLANs both at Layer 2 and at Layer 3. Protecting the perimeter of the network with a firewall is the first step in securing this network configuration. Securing the flow of traffic between multiple internal VLANs, however, can be a more difficult task. Figure 19-1. Basic Switched Network
When integrating the FWSM into your network's security configuration, you need to decide on the location of the MSFC. The MSFC enables your switch to forward traffic between multiple VLANs because it performs routing or Layer 3 functionality. You can configure your MSFC in one of the following three configurations. Each is discussed in more detail in the following pages.
Multilayer Switch Feature Card as the Inside RouterFigure 19-2 shows a FWSM configuration with the MSFC used as a router on the network inside the firewall. VLANs 100, 200, and 700 are configured as firewall VLANs. The MSFC is connected to VLAN 100 (which is a firewall-controlled VLAN). In this configuration, traffic between VLANs 300, 400, 500, and 800 is routed by the MSFC without passing through the FWSM. All other traffic is routed through the FWSM. Figure 19-2. MSFC Inside FWSM Network Multilayer Switch Feature Card as the Outside RouterFigure 19-3 shows a FWSM configuration with the MSFC used as a router on the network outside the firewall. All of the VLANs (except VLAN 600 and 700) are controlled by the FWSM. Therefore, only traffic from the Internet to VLAN 600 is handled by the MSFC. All other traffic is subject to the rules on the FWSM. Figure 19-3. MSFC Outside FWSM Network Multilayer Switch Feature Card Not Directly Connected to FWSMBesides connecting the MSFC to either the inside or outside of the FWSM, you can also set up a configuration in which the MSFC is not directly connected to any of the FWSM interfaces. In this situation, there is no interaction between the MSFC and the FWSM. Initializing the Firewall Services ModuleWhen you configure a PIX Firewall, you can run the setup command and the firewall is ready to go. The FWSM, on the other hand, receives traffic directly from the Catalyst switch's backplane. This increases the initial configuration task required to make the FWSM operational. Initially configuring the FWSM involves the following tasks:
Switch ConfigurationBefore you can use the firewall functionality on your network traffic, you need to perform several configuration tasks on the switch. To configure the switch to operate with your FWSM, you need to perform the following steps:
NoteThe switch configuration steps outlined in the following sections assume that your switch is running Cisco IOS software. If you are using the Catalyst operating system (CatOS), please refer to the documentation for the configuration steps. Create Virtual LANsEach interface on the FWSM receives traffic from specific VLAN(s) on your switch. To create VLANs on your switch you use the vlan command. The syntax for this command is as follows: Next you need to be able to route traffic between VLANs using the MSFC. By default, routers route traffic between the networks to which they are physically connected. With the MSFC, you can create virtual interfaces connected to the various VLANs on your switch. These virtual interfaces enable your switch to control the flow of traffic between the different networks defined by the configured VLANs. To create a virtual interface for a VLAN, use the interface vlan command. The syntax for this command is as follows:
Define Firewall vlan-groupAt a minimum, you need to specify two VLANs when configuring your FWSM. One of these VLANs represents the network being protected by the FWSM. All traffic for this VLAN will be sent through the FWSM for analysis before being sent to the actual devices on the VLAN. The other VLAN represents the network outside the FWSM.Normally, the switch passes traffic to the MSFC, and the MSFC routes traffic between the various VLANs configured on the switch. When using the FWSM, however, you want certain traffic to be sent to the FWSM instead of to the MSFC. To accomplish this, you need to define a group of VLANs that will be controlled by the FWSM by using the firewall vlan-group command. The syntax for this command is as follows:
Table 19-3 describes the parameters associated with the firewall vlan-group command.
Associate the vlan-group with the ModuleFinally, you need to inform the switch in which switch slot the FWSM is located. You can have multiple FWSMs in a single switch, so this command is used to identify which blade will receive the traffic for a specific firewall vlan-group. This association is defined using the firewall module switch command, and its syntax is as follows: Table 19-4 describes the parameters associated with the firewall module command.
Example 19-1. Configuring the MSFC on the Inside Interface
Basic Firewall Services Module ConfigurationTo initially set up the FWSM, perform the following tasks on it:
Because you are initially configuring the FWSM, you need to gain access to the command-line interface (CLI) on the FWSM from the switch CLI. The session slot command enables you to access the CLI on your various switch modules. The syntax for this command is as follows: NoteWhen accessing the FWSM, you use a processor ID of 1.If your FWSM is located in slot 3 on your switch, you would use the following command to connect to the FWSM CLI from the switch CLI: At the passwd prompt, you need to enter the password for Telnet console access on the FWSM.NoteThe default password for Telnet console access is cisco . For security reasons, you should change the default password using the passwd command from the privileged mode on the FWSM. Running the setup CommandJust like on the PIX Firewall, the setup command enables you to configure many of the basic parameters on the FWSM quickly, such as the following:
Example 19-2 is a sample of the output and questions provided by the setup command: Example 19-2.
Configuring the InterfacesUnlike the PIX Firewall, the FWSM does not have a default inside and outside interface. Initially, you associate two or more VLANs with the FWSM (using the firewall vlan-group and firewall module switch commands). On the FWSM, however, you must assign each VLAN to a specific interface name and assign each interface an IP address. To assign a switch VLAN a specific interface name on the FWSM you use the nameif command. The syntax for this command is as follows: The parameters for the nameif interface commands are shown in Table 19-5.
Table 19-6 shows the parameters for the ip address command. Besides the IP address, you need to provide a netmask that identifies the network portion of the IP address.
Configuring the Access ListsTraffic from the protected network through the PIX Firewall is allowed by default. The FWSM, on the other hand, explicitly defines access lists on all its interfaces. Therefore, even traffic from your protected network is denied unless you create an access list to allow it. To define access lists, you use the following two commands:
The access-list command defines the traffic that you want to allow. Then you use the access-group command to assign your access list to a specific interface. Chapter 7, "Configuring Access," explains the commands in more detail. Using PIX Device Manager with the Firewall Services ModuleJust like the PIX Firewall, you can manage the FWSM using the Cisco PDM. Before you can use PDM, however, you need to perform the following tasks:
Initial PreparationThe initial switch configuration tasks to use PDM include the same configuration tasks required to configure the FWSM initially, such as the following switch configuration:
You also need to perform the initial FWSM configuration tasks, which include the following:
Running the setup command enables access to PDM from the host that you specify in response to the following prompt: In addition, you must configure your access lists to enable traffic to reach the PDM web server (HTTP over SSL, or HTTPS) from the PDM client IP address.NoteYou also can enable Hypertext Transfer Protocol (HTTP) access using the http server command and define which systems have HTTP access to the FWSM using the http <local-ip> command. Installing the PIX Device Manager ImageThe FWSM (Version 1.1) does not come with PDM preinstalled. You need to place the PDM software image on your FWSM. The FWSM Version 1.1 requires PDM Version 2.1. To install the PDM software on your FWSM, you use the copy tftp command. The syntax for this command is as follows: For instance, suppose that the following information matches the PDM image that you want to install on your FWSM:
The following command will install this image on your FWSM: You can verify that PDM is installed on your FWSM by using the show version command as shown in the following:
Launching PIX Device ManagerWhen accessing PDM to configure your FWSM, you use a secure HTTP connection (HTTPS). The address to which you connect is one of the IP addresses that you configured for one of the interfaces on the FWSM.NoteThe browser that you use to connect to PDM must have Java and JavaScript enabled. For complete details on the browser requirements, refer to the "Cisco PIX Device Manager Installation Guide."Suppose the address of your FWSM is 10.10.10.1. To connect to PDM, you would enter in your browser a Uniform Resource Locator (URL) similar to the following:
Troubleshooting the Firewall Services ModuleBesides the basic software troubleshooting commands available through the FWSM (similar to PIX debugging commands), you also can debug the operational status of the FWSM from the switch. These basic troubleshooting operations fall into the following categories:
Switch CommandsTo troubleshoot the operation of your FWSM, you can use several switch commands. The switch commands to troubleshoot the operation of the FWSM fall into the following categories:
Module StatusTo verify that the Catalyst 6500 switch correctly recognizes the FWSM, you can use the show module switch command. The syntax for this command is as follows: By viewing the output of this command, you can verify that the switch recognizes the correct card type (Firewall Module) for the module number where you have installed the FWSM.You also can check the FWSM status. Using the show module command without any arguments provides information on all of the modules on the switch, as shown in Example 19-3. Example 19-3. Viewing Module Status
Memory TestBy default, the FWSM performs only a partial memory test when the module boots up. You can change this behavior so that it performs a full memory test. When the FWSM is configured for a full memory test, it takes longer to boot. Table 19-7 shows the time required to perform full memory tests for two different memory sizes.
NoteThe hw-module command is specific to Cisco IOS and is not available if your switch is running the Catalyst operating system (CatOS) software. Resetting and RebootingIf you cannot access the FWSM either through Telnet or the session command on the switch, you need to reset the module from the switch. For Cisco IOS software, the hw-module switch command resets individual modules. The syntax for this command when resetting a module is as follows: For instance, to reset the FWSM located in slot 4 you would use the following command on the switch: NoteYou also can use the hw-module command to access the maintenance partition on the FWSM. To reboot the module into the maintenance partition, you use the following command: NoteThe hw-module command is available only in Cisco IOS software. If you are using CatOS, you need to use the reset command to reset/reboot the FWSM from the switch command line or access the maintenance partition. Firewall Services Module Status LEDEach FWSM has a status LED on its front panel that indicates its current operational state. Table 19-8 describes the different states the status LED indicates.
|
لطفا منتظر باشید ...
