Firewall Services Module on the Cisco 6500 Switches

Posted on 2006-05-02
Last Modified: 2011-10-03
Can you please let me know if the Firewall Services Module (FWSM) on the Cisco 6500 series switches is as good as a Cisco ASA or a PIX firewall ? Does the FWSM have all the capabilities of the Cisco ASA/PIX ?
For a production Data Center running business critical applications - which one is a better solution ?



Question by:jaisimha_4474
    LVL 19

    Accepted Solution

    FWSM does have a slightly different featureset to the PIX/ASA family - specifically because they are designed for slightly different situations.  Some of the good stuff:  
    FWSM supports huge throughput - 5GB which is more than any PIX
    Support up to 100 firewall VLANS -
    Supports failover but does not need a specific failover license
    1 million concurrent connections and up to 2 million acls compared to 128000 - PIX (practically is can run about 80000)
    Supports ISL - although this is not as widely used as before

    On the bad side:
    Does not support conduits, activex and java fixups, bidirectional nat
    Also - and this can be a big thing - it takes up a slot in your 6500 chassis.  Which is 48 less ports for your datacenter - this may or may not be an issue.

    For your environment - I would factor in bandwidth, no of servers, availability, and  I would probably side with dual PIXs in a failover configuration or a newer ASA series model.

    LVL 79

    Assisted Solution

    If the primary purpose of the firewall is to protect Internet access, then I would suggest an external ASA5500 or PIX.
    If the primary purpose of the firewall is to create separate security zones within the data center, then the FWSM is the better choice.

    Author Comment

    Thanks to both of you for the comments.

    I also wanted to know - what is this bi-directional NAT ?

    Can the FWSM support NAT/PAT together and can it do Port Redirection as well.
    LVL 19

    Assisted Solution

    hi again

    bi-directional NAT - 2 way nat.  It allows you to nat from the outside to the inside (as well as the normal inside to outside nat).  With a pix you can assign an outside nat pool and translate it to a global inside pool - this is not possible with a FWSM

    Can the FWSM support NAT/PAT together and can it do Port Redirection as well.
    Yep - all three


    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
    Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now