Mark, these were my concerns, per your comment as acting as a perimeter firewall.
i appreciate the info and feedback this is going to be very helpful and will help me present my case to keep corp/infrastructure firewalls on standalone asa's On Feb 13, 2008 1:06 PM, Mark Kent <[EMAIL PROTECTED]> wrote: > AFAIK, the FWSM is not going to be able to be a general perimeter > firewall, in conjunction with other contexts. That is, if you think > "Hey, I've got multiple contexts, why not use one for general > Internet filtering and then that can funnel into per-customer > and/or per-businessUnit contexts?" then the answer is "it'll confuse > the classifier for outbound traffic" > > The fwsm does not seem to be as "advanced" as the ASA in at least > a few ways (no enhanced object groups, no ability to tie a unique MAC > address to shared interfaces). > > Also, multiple contexts means static routing. > > Regarding this: > > > I would also ask a strategy question, Do you think the FWSM > > product really has a future compared to ASA? > > Is that rhetorical? Is it generally believed that the answer is "No"? > > Regarding this comment: > > > We recently had an issue where one of the network processors in an > > FWSM got confused and refused to pass traffic for new flows. > > I think that happened to me yesterday (with 3.2(4)). Spent hours > trying to figure out what was going on, finally ripped out the > contexts, redefined them and all was OK. This isn't even in > production yet (i.e., no real load). > > Thanks, > -mark > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
