Firewall Services Module on the Cisco 6500 Switches

Posted on 2006-05-02
Medium Priority
Last Modified: 2011-10-03
Can you please let me know if the Firewall Services Module (FWSM) on the Cisco 6500 series switches is as good as a Cisco ASA or a PIX firewall ? Does the FWSM have all the capabilities of the Cisco ASA/PIX ?
For a production Data Center running business critical applications - which one is a better solution ?



Question by:jaisimha_4474
  • 2
LVL 19

Accepted Solution

nodisco earned 1350 total points
ID: 16586575
FWSM does have a slightly different featureset to the PIX/ASA family - specifically because they are designed for slightly different situations.  Some of the good stuff:  
FWSM supports huge throughput - 5GB which is more than any PIX
Support up to 100 firewall VLANS -
Supports failover but does not need a specific failover license
1 million concurrent connections and up to 2 million acls compared to 128000 - PIX (practically is can run about 80000)
Supports ISL - although this is not as widely used as before

On the bad side:
Does not support conduits, activex and java fixups, bidirectional nat
Also - and this can be a big thing - it takes up a slot in your 6500 chassis.  Which is 48 less ports for your datacenter - this may or may not be an issue.

For your environment - I would factor in bandwidth, no of servers, availability, and  I would probably side with dual PIXs in a failover configuration or a newer ASA series model.

LVL 79

Assisted Solution

lrmoore earned 150 total points
ID: 16586836
If the primary purpose of the firewall is to protect Internet access, then I would suggest an external ASA5500 or PIX.
If the primary purpose of the firewall is to create separate security zones within the data center, then the FWSM is the better choice.

Author Comment

ID: 16589633
Thanks to both of you for the comments.

I also wanted to know - what is this bi-directional NAT ?

Can the FWSM support NAT/PAT together and can it do Port Redirection as well.
LVL 19

Assisted Solution

nodisco earned 1350 total points
ID: 16631814
hi again

bi-directional NAT - 2 way nat.  It allows you to nat from the outside to the inside (as well as the normal inside to outside nat).  With a pix you can assign an outside nat pool and translate it to a global inside pool - this is not possible with a FWSM

Can the FWSM support NAT/PAT together and can it do Port Redirection as well.
Yep - all three


Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This applies to Dell but may also apply to other manufacturers as well. We ran across a few machines that just dropped recently it trust relationship with the server. After doing the basic removing and joining the domain again, it changed to No logo…
If you try to migrate from Elastix to Issabel, you will face a lot of issues. These problems are inevitable but fortunately, you can fix them. In the guide below, I will explain how I performed the migration while keeping all data and successfully t…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question