Hello, we are trying to set up a new network. We are trying to tie several switches to a Cat6506 with the FWSM integrated. We have the switches going into the FWSM. The outside interface is the MSFC of the 6506. From there it goes to the outside world. We are running OSPF between everything. All of the switches sees the networks of the other switches. The problem is that none of the switches can ping or pass other traffic to the other switches. The FWSM can only ping IPs off the MSFC card. Those IPS can also ping the FWSM but nothing else. I do not need NAT (did a no nat-control). Here are the config snipets. What am I missing? Thanks in advance for the help.
Cat6506: wfs-cz1-2201# sh run hostname wfs-cz1-2201 ! firewall multiple-vlan-interfaces firewall module 1 vlan-group 2, firewall vlan-group 2 330,334,338,342,346,350,358,702 ip subnet-zero no ip source-route ! vlan 330 name wfs-nmz-2201_uplink ! vlan 334 name wfs-sz1-2201_uplink ! vlan 702 name fwsm ! interface Loopback0 description Protocol Mgmt (OSPF,SNMP,TACACS,SYSLOG,NTP) ip address 10.241.158.254 255.255.255.255 no ip redirects no ip unreachables no ip proxy-arp ! interface Port-channel1 description EC to wfs-sz1-2201 switchport switchport access vlan 334 switchport mode access ! interface Port-channel6 description EC to wfs-nmz-2201 switchport switchport access vlan 330 switchport mode access ! interface GigabitEthernet3/1 description To wfs-sz1-2201 G1/45 switchport switchport access vlan 334 switchport mode access channel-group 1 mode on ! interface GigabitEthernet3/2 description To wfs-sz1-2201 G1/46 switchport switchport access vlan 334 switchport mode access channel-group 1 mode on ! interface GigabitEthernet3/5 description To wfs-nmz-2201 G1/45 switchport switchport access vlan 330 switchport mode access channel-group 6 mode on ! interface GigabitEthernet3/6 description To wfs-nmz-2201 G1/46 switchport switchport access vlan 330 switchport mode access channel-group 6 mode on ! interface Vlan702 description FWSM ip address 10.241.158.225 255.255.255.252 no ip redirects no ip proxy-arp ip ospf message-digest-key 1 md5 xxxxxx ip ospf network point-to-point ip ospf priority 0 ! router ospf 1 router-id 10.241.158.254 log-adjacency-changes detail area 0 authentication message-digest area 1301 authentication message-digest redistribute static subnets network 10.241.158.128 0.0.0.0 area 0 network 10.241.158.162 0.0.0.0 area 1301 network 10.241.158.225 0.0.0.0 area 0 network 10.241.158.234 0.0.0.0 area 0 network 10.241.158.254 0.0.0.0 area 0 network 143.57.156.254 0.0.0.0 area 0 network 172.24.10.97 0.0.0.0 area 10 default-information originate metric 1 ! ip classless ip route 0.0.0.0 0.0.0.0 10.241.158.238 ! FWSM: hostname wfs-fx1-2201 ! interface Vlan330 nameif wfs-nmz-2201 security-level 100 ip address 10.241.158.130 255.255.255.254 ospf network point-to-point non-broadcast ospf message-digest-key 1 md5 <removed> ! interface Vlan334 nameif wfs-sz1-2201 security-level 100 ip address 10.241.158.134 255.255.255.254 ospf network point-to-point non-broadcast ospf message-digest-key 1 md5 <removed> ! interface Vlan702 nameif enclave_uplink security-level 0 ip address 10.241.158.226 255.255.255.252 ospf network point-to-point non-broadcast ospf message-digest-key 1 md5 <removed> ! same-security-traffic permit inter-interface access-list ANY extended permit ip any any access-list ANY extended permit tcp any any access-list ANY extended permit udp any any access-list ANY extended permit icmp any any access-list NET extended permit ip any any mtu wfs-nmz-2201 1500 mtu wfs-sz1-2201 1500 mtu enclave_uplink 1500 no failover icmp permit any wfs-nmz-2201 icmp permit any wfs-sz1-2201 icmp permit any enclave_uplink no asdm history enable arp timeout 14400 access-group ANY in interface wfs-nmz-2201 access-group ANY out interface wfs-nmz-2201 access-group ANY in interface wfs-sz1-2201 access-group ANY out interface wfs-sz1-2201 access-group ANY in interface enclave_uplink access-group ANY out interface enclave_uplink ! router ospf 1 network 0.0.0.0 0.0.0.0 area 0 area 0 authentication message-digest neighbor 10.241.158.225 neighbor 10.241.158.135 neighbor 10.241.158.131 log-adj-changes default-information originate metric 1 ! class-map inspection_default match default-inspection-traffic ! ! policy-map global_policy class inspection_default inspect dns maximum-length 512 inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect skinny inspect smtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp inspect icmp error ! service-policy global_policy global prompt hostname context One of the Switches (all are of similar config) hostname wfs-sz1-2201 ! ip subnet-zero no ip source-route no ip dhcp use vrf connected ! port-channel load-balance src-dst-port ! vlan 2 name SRV1 ! vlan 10 name MGMT ! vlan 20 name LOM ! vlan 64 name SVR ! interface Loopback0 description Protocol Mgmt (OSPF,SNMP,TACACS,SYSLOG,NTP) ip address 10.241.158.246 255.255.255.255 no ip redirects no ip proxy-arp no ip unreachables ! interface Port-channel1 description EC to wfs-cz1-2201 ip address 10.241.158.135 255.255.255.254 no ip redirects no ip proxy-arp ip ospf message-digest-key 1 md5 xxxx ip ospf network point-to-point ! interface Port-channel2 description EC to wfs-cz2-2201 ip address 10.241.158.137 255.255.255.254 no ip redirects no ip proxy-arp ip ospf message-digest-key 1 md5 xxxx ip ospf network point-to-point ! interface GigabitEthernet1/45 description To wfs-cz1-2201 port G3/1 media-type sfp no switchport channel-group 1 mode on ! interface GigabitEthernet1/46 description To wfs-cz1-2201 port G3/2 media-type sfp no switchport channel-group 1 mode on ! router ospf 1 router-id 10.241.158.246 log-adjacency-changes detail area 0 authentication message-digest area 22011 authentication message-digest network 10.241.158.135 0.0.0.0 area 0 network 10.241.158.137 0.0.0.0 area 0 network 10.241.158.246 0.0.0.0 area 22011 network 143.57.156.1 0.0.0.0 area 22011 network 143.57.156.65 0.0.0.0 area 22011 network 172.24.10.33 0.0.0.0 area 22011 network 172.24.10.225 0.0.0.0 area 22011 default-information originate metric 1 ! ip classless _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
