Table Of Contents

Quick Start Steps

Routed Firewall Configuration Steps

Transparent Firewall Configuration Steps

Quick Start Steps

---

The following sections describe the minimum configuration required for the Firewall Services Module (FWSM) in routed mode or transparent mode:

•Routed Firewall Configuration Steps

•Transparent Firewall Configuration Steps

Routed Firewall Configuration Steps

Follow these steps to configure the FWSM in routed mode:

	Task	Description
Step 1	Assigning VLANs to the Firewall Services Module	On the switch, you need to assign VLANs to the FWSM so the FWSM can send and receive traffic on the switch.
Step 2	(Might be required) Adding Switched Virtual Interfaces to the MSFC	If you want the Multilayer Switch Feature Card (MSFC) to route between VLANs that are assigned to the FWSM, complete this procedure.
Step 3	Sessioning and Logging into the Firewall Services Module	From the switch CLI, you can session into the FWSM to access the FWSM CLI.
Step 4	(Might be required; multiple context mode only) Enabling or Disabling Multiple Context Mode	If you want to use multiple context mode and your FWSM is not already configured for it, or if you want to change back to single mode, follow this procedure.
Step 5	(Multiple context mode only) Configuring a Security Context	Add a security context.
Step 6	(Multiple context mode only) Changing Between Contexts and the System Execution Space	You must configure some settings in the system execution space, and some settings within the context, so you need to know how to switch between contexts and the system execution space.
Step 7	Setting the Name and Security Level	For each VLAN interface, you must set a name (such as inside or outside) and a security level.
Step 8	Assigning IP Addresses to Interfaces for a Routed Firewall	Assign an IP address to each interface.
Step 9	Configuring the Default Route	Create a default route to an upstream router.
Step 10	Configure routing using one of these methods: •Configuring Static Routes •(Single context mode only) Configuring OSPF •(Single context mode only) Configuring RIP	In multiple context mode, static routing is the only routing method supported. In single mode, you have a choice of static, RIP, or OSPF. RIP support is for passive mode only.
Step 11	Use one or more of these NAT methods: •Using Dynamic NAT and PAT •Using Static NAT •Using Static PAT •Bypassing NAT	You must specifically configure some interfaces to either use or bypass NAT. Typically, if you want to allow inside users to access the outside or other networks attached to the FWSM, configure dynamic NAT or PAT according to the "Using Dynamic NAT and PAT" section. If you want to allow outside users to access an inside host, then configure static NAT according to the "Using Static NAT" section. The FWSM offers a large amount of flexibility in your NAT configuration.
Step 12	Adding an Extended Access Control List	Before any traffic can go through the FWSM, you must create an ACL that permits traffic, and then apply it to an interface.

Transparent Firewall Configuration Steps

Follow these steps to configure the FWSM in transparent mode:

	Task	Description
Step 1	Assigning VLANs to the Firewall Services Module	On the switch, you need to assign VLANs to the FWSM so the FWSM can send and receive traffic on the switch.
Step 2	(Might be required) Adding Switched Virtual Interfaces to the MSFC	If you want the MSFC to route between VLANs that are assigned to the FWSM, complete this procedure.
Step 3	Sessioning and Logging into the Firewall Services Module	From the switch CLI, you can session into the FWSM to access the FWSM CLI.
Step 4	Setting the Firewall Mode	Before you configure any settings, you must set the firewall mode to transparent mode. Changing the mode clears your configuration.
Step 5	(Might be required; multiple context mode only) Enabling or Disabling Multiple Context Mode	If you want to use multiple context mode and your FWSM is not already configured for it, or if you want to change back to single mode, follow this procedure.
Step 6	(Multiple context mode only) Configuring a Security Context	Add a security context.
Step 7	(Multiple context mode only) Changing Between Contexts and the System Execution Space	You must configure some settings in the system execution space, and some settings within the context, so you need to know how to switch between contexts and the system execution space.
Step 8	Setting the Name and Security Level	For each VLAN interface, you must set a name (such as inside or outside) and a security level.
Step 9	Setting the Management IP Address for a Transparent Firewall	The transparent firewall requires a management IP address.
Step 10	Adding an Extended Access Control List	Before any traffic can go through the FWSM, you must create an ACL that permits traffic, and then apply it to an interface.