Customizing The Fwsm Internal Interface - Cisco 7604 Configuration Manual

Customizing the FWSM Internal Interface

Router(config)# firewall vlan-group 51 70-85
Router(config)# firewall module 8 vlan-group 50-51
Router(config)# firewall multiple-vlan-interfaces
Router(config)# interface vlan 55
Router(config-if)# ip address 10.1.1.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# interface vlan 56
Router(config-if)# ip address 10.1.2.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# end
Router#
The following is sample output from the show interface command:
Router# show interface vlan 55
Vlan55 is up, line protocol is up
Hardware is EtherSVI, address is 0008.20de.45ca (bia 0008.20de.45ca)
Internet address is 10.1.1.1/24
MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
Encapsulation ARPA, loopback not set
ARP type:ARPA, ARP Timeout 04:00:00
Last input never, output 00:00:08, output hang never
Last clearing of "show interface" counters never
Input queue:0/75/0/0 (size/max/drops/flushes); Total output drops:0
Queueing strategy:fifo
Output queue :0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
L2 Switched:ucast:196 pkt, 13328 bytes - mcast:4 pkt, 256 bytes
L3 in Switched:ucast:0 pkt, 0 bytes - mcast:0 pkt, 0 bytes mcast
L3 out Switched:ucast:0 pkt, 0 bytes
Customizing the FWSM Internal Interface
The connection between the FWSM and the switch is a 6-GB 802.1Q trunking EtherChannel. This
EtherChannel is automatically created when you install the FWSM. On the FWSM side, two NPs
connect to three Gigabit Ethernet interfaces each, and these interfaces comprise the EtherChannel. The
switch distributes traffic to the interfaces in the EtherChannel according to a distribution algorithm based
on session information; load sharing is not performed on a per-packet basis, but rather on a flow basis.
In some cases, the algorithm assigns traffic unevenly between the interfaces and, therefore, between the
two NPs. Aside from not utilizing the full processing potential of the FWSM, consistent inequity can
result in unexpected behavior when you apply resource management to multiple contexts. (See the
"Configuring a Class" section on page 4-24
To change the load-balancing method, enter the following command:
Router(config)# port-channel load-balance {dst-ip | dst-mac | dst-port | src-dst-ip |
src-dst-mac | src-dst-port | src-ip | src-mac | src-port}
The default is src-dst-ip.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
2-8
reliability 255/255, txload 1/255, rxload 1/255
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
4 packets output, 256 bytes, 0 underruns
0 output errors, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
Chapter 2 Configuring the Switch for the Firewall Services Module
for more information.)
OL-20748-01