The Cisco® Firewall Services Module (FWSM) for Cisco Catalyst® 6500 Series switches and Cisco 7600 Series routers is a high-performance, integrated stateful inspection firewall with application and protocol inspection engines. It provides upto 5.5 Gbps of throughput, 100,000 new connections per second, one million concurrent connections or 256,000 NAT translations and upto 80,000 Access Control List Entries. Up to four FWSMs can be installed in a single chassis, providing scalability up to 20 Gbps per chassis. As an extension to the Cisco PIX®/ASA family of security appliances, the FWSM provides large enterprises and service providers with superior security, performance, and reliability.
Based on Cisco PIX/ASA firewall technology, the FWSM is a hardened, embedded system that eliminates security holes and performance-degrading overhead. The Cisco FWSM tracks the state of all network communications and prevents unauthorized network access. It delivers strong application-layer security through intelligent, application-aware inspection engines that examine network flows at Layers 4-7, including market-leading protection for voice over IP (VoIP), multimedia, instant messaging, and peer-to-peer applications.
Flexible Management Options
The Cisco FWSM is managed by the integrated Cisco PIX Device Manager (PDM) for the Cisco FWSM Software v2.3 or earlier, or by the Cisco Adaptive Security Device Manager (ASDM) for Cisco FWSM Software v3.1 or later for device and policy configuration, monitoring, and troubleshooting of a single FWSM. Cisco PDM can be launched from the CiscoWorks CiscoView Device Manager (CVDM) for device provisioning of Cisco Catalyst switches and other services modules. The Cisco FWSM can also be managed from centralized, scalable, multidevice policy-based management tools, including CiscoWorks VPN/Security Management Solution (VMS); the Cisco Security Manager; and the Cisco Security Monitoring, Analysis, and Response System (MARS). Together with other security devices, these central management tools manage the FWSM throughout the network in a consistent manner to best expedite large security deployments.
Security Services Integration
The Cisco FWSM can be combined with other Cisco security services modules such as the Intrusion Detection Services Module (IDSM-2), IP Security (IPSec) VPN Shared Port Adapter (SPA), Traffic Anomaly Detection Module (ADM), Anomaly Guard Module (AGM), and the Network Analysis Module (NAM-1 and NAM-2). Together, these services modules provide a complete self-defending network solution. Integration of service modules into one chassis allows for ease of use and support for network administrators. Role-based remote access controls fosters collaboration for IT managers.
With this modular approach, customers can use their existing switching and routing infrastructures for cost-effective deployment-and can do so while obtaining the highest performance available in the industry and providing secured IP services along with multilayer LAN and WAN switching and routing capabilities.
Firewall Services Module Benefits
Integrated Module Enhances Security and Lowers Cost of Ownership
Besides protecting the perimeter of the corporate network from threats, the Cisco FWSM is installed inside a Cisco Catalyst 6500 Series switch or Cisco 7600 Series router, inspects traffic flows and prevents unauthorized users from accessing a particular subnet, workgroup, or LAN within a corporate network. This intelligent network integration allows the FWSM to provide greater investment protection, a lower total cost of ownership, and a reduced footprint where power and rack space are at a premium. Any physical port on the switch can be configured to operate with firewall policy and protection, allowing for easy deployment without additional configuration and cabling, and providing firewall security inside the network infrastructure. The FWSM can be deployed together with other Cisco Catalyst 6500 Series and Cisco 7600 Series security services modules, for a secure, multilayer defense-in-depth IP services solution.
High Performance, High Scalability and Low Latency Ready for the Future
The FWSM is based on high-speed network processors that provide high performance but retain the flexibility of general-purpose CPUs. The Cisco FWSM provides industry-leading performance of upto 100,000 new connections per second, 5.5 Gbps of throughput, and one million concurrent connections per service module. This superior performance helps organizations meet future growing requirements without requiring a system overhaul. Multiple FWSMs can be clustered using static VLAN configurations or the Catalyst 6500 IOS Policy-based Routing (PBR) for directing traffic to these FWSMs. Up to four FWSMs can be deployed in the same chassis for a total of 20 Gbps throughput. A single FWSM can support up to 1000 virtual interfaces (maximum of 100 per context), and a single chassis can scale up to a maximum of 4000 VLANs. In addition, two Cisco Application Control Engines (ACE) can be used within the Catalyst 6500 chassis to load balance three FWSMs for over 15Gbps of firewall throughput, over 150,000 connections per second and two million concurrent connections.
Full firewall protection is applied across the switch backplane, giving the lowest latency figures (30 microseconds for small frames) possible. This is important to secure latency-sensitive applications such as financial market data and voice over IP (VoIP).
Service Virtualization Reduces Cost and Complexity of Management
The Cisco FWSM provides service virtualization, which allows service providers and large enterprises to implement separate policies for different customers or functional areas, such as multiple demilitarized zones (DMZs), over the same physical infrastructure. Virtualization helps reduce the cost and complexity of managing multiple devices, and makes it easier to add or delete security contexts as subscribers grow. A single FWSM can be partitioned into a maximum of 250 virtual firewalls (security contexts) in Cisco FWSM Software v3.1 or above. FWSM virtualization includes support for Transparent Mode (Layer 2) and Routed Mode (Layer 3). All policies, monitoring and logging are supported in FWSM virtualization which includes Network Address Translation (NAT), access control lists (ACLs), inspection engines, Simple Network Management Protocol (SNMP), syslog, and Dynamic Host Control Protocol (DHCP), and more.
The FWSM Resource Manager helps ensure high availability by limiting resource usage allocated to each security context at any time. This can prevent certain contexts from consuming all resources and denying those resources to other contexts. These resources include number of connections, local hosts, NATs, ACLs, bandwidth, inspection rates, and syslog rates. Role-based management allows multiple IT owners to configure and manage network-and application-layer security policies. Used at the Internet edge, the FWSM can be configured to map virtual firewalls to virtual routing and forwarding instances (VRFs) to provide complete traffic separation and security on the campus network. With the default FWSM software, up to two security contexts and an additional special administrative context are provided. For more security contexts, a license must be purchased.
Ease of Deployment with Transparent (Layer 2) Firewall
The transparent firewall feature configures the FWSM to act as a Layer 2 bridging firewall and requires minimal changes to the network topology. The use of a transparent firewall reduces both the configuration and deployment time. There are no IP addresses except for the management interface; no subnetting or configuration updates are required with transparent firewalls. The transparent firewall feature greatly simplifies deployment in the data center for protecting hosts. The transparent firewalls also fit into existing networks with no Layer 3 changes and transparently pass Layer 3 traffic from routers, allowing interoperability with IP services such as Hot Standby Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), Gateway Load Balancing Protocol (GLBP), Multicast, and non-IP traffic such as Internetwork Packet Exchange (IPX), Multiprotocol Label Switching (MPLS), and bridge protocol data units (BPDUs). The transparent firewall is also supported for multiple virtual firewalls. With the release of Cisco FWSM Software v3.1, a mixture of transparent firewall and routed firewall can also be implemented on the same FWSM, providing the most flexible network deployment options. All Layer 3 firewall features are supported with transparent firewall, including NAT and PAT in Cisco FWSM Software v3.2.
High Availability
For network resilience, the Cisco FWSM supports high-speed failover between modules within a single Cisco Catalyst 6500 or Cisco 7600 chassis (intrachassis) and between modules in separate chassis (interchassis), offering customers complete flexibility in their firewall deployments. Cisco FWSM Software v3.1 adds Active-Active stateful failover support in multiple context mode in addition to Active-Standby stateful failover.
Robust Stateful Inspection and Application-Layer Security
The Cisco FWSM is based on the Cisco PIX firewall technology, also known as the Adaptive Security Algorithm (ASA). The FWSM offers rich stateful inspection firewall services, tracking the state of all network communications, applying security policy, and preventing Denial of Service attacks and unauthorized network access. The FWSM creates a connection table entry for a session flow based on the source and destination addresses, randomized TCP sequence numbers, port numbers, and additional TCP flags, and applies security policy to these connections.
Building upon the network-based firewall services, the FWSM also delivers strong application-layer security through intelligent, application-aware inspection engines that examine network flows at Layers 4-7. To defend networks from application-layer attacks, these inspection engines incorporate extensive application and protocol knowledge, and employ security enforcement technologies that include standards conformance checking, protocol anomaly detection, application and protocol state tracking, bidirectional NAT services, bidirectional ACLs, Port Address Translation (PAT), and attack detection and mitigation techniques such as application/protocol command filtering, content verification, URL obfuscation, and URL filtering. These inspection engines give businesses control over instant messaging, peer-to-peer file sharing, and tunneling applications. In addition, the FWSM provides market-leading protection for a wide range of VoIP and other multimedia standards.
Cisco FWSM Platform Performance and Capacities
Table 1 provides information on the performance and capacity of the Cisco FWSM.
Table 1. Cisco FWSM Platform Performance and Capacities
| |
Capacities
|
|
Performance
|
• 5.5 Gbps throughput per service module
• Up to 4 FWSMs (20 Gbps) per Catalyst 6500 chassis with static VLAN or IOS Policy-based Routing
• 2.8 Mpps
• 1 million concurrent connections
• 100,000 connection setups and teardowns per second
• 256,000 concurrent NAT or PAT translations
• Jumbo Ethernet packets (8500 bytes) supported
|
|
VLAN Interfaces
|
• 1000 total per service module
• 256 VLANs per security context in routed mode
• 8 VLAN pairs per security context in transparent mode
|
|
Access Lists
|
• Up to 80,000 Access Control Entries in single context mode
• Note: the FWSM implements Layer 3 and 4 access control security checks in hardware with virtually no performance impact using non-upgradeable high-speed memory
|
|
Virtual Firewalls (Security Contexts)
|
• 20, 50, 100, 250 Virtual Firewall licenses
• 2 Virtual Firewalls and 1 administrative context are provided for testing purposes.
|
Cisco Firewall Services Module Hardware and Software Part Numbers
|
Product Number
|
Description
|
|
Hardware
|
|
WS-SVC-FWM-1-K9
|
Firewall Services Module for Cisco Catalyst 6500 and 7600 Series
|
|
WS-SVC-FWM-1-K9=
|
Firewall Services Module for Cisco Catalyst 6500 and 7600 Series (spare)
|
|
Security Bundles
|
|
WS-C6506-E-FWM-K9
|
Cisco Catalyst 6506 Firewall Security System with Enhanced Chassis and Supervisor 720 3B
|
|
WS-C6509-E-FWM-K9
|
Cisco Catalyst 6509 Firewall Security System with Enhanced Chassis and Supervisor 720 3B
|
|
WS-C6513-FWM-K9
|
Cisco Catalyst 6513 Firewall Security System with Supervisor 720 3B
|
|
WS-6509EXL-2FWM-K9
|
Cisco Catalyst 6509 Firewall Security System with Enhanced Chassis, Supervisor 720 3BXL and two Firewall Service Modules
|
|
WS-6513XL-2FWM-K9
|
Cisco Catalyst 6513 Firewall Security System with Supervisor 720 3BXL and two Firewall Service Modules
|
|
WS-6506-EXL-FWM-K9
|
Cisco Catalyst 6506 Firewall Security System with Enhanced Chassis, Supervisor 720 3BXL and one Firewall Service Module
|
|
WS-6509-EXL-FWM-K9
|
Cisco Catalyst 6506 Firewall Security System with Enhanced Chassis, Supervisor 720 3BXL and one Firewall Service Module
|
|
WS-C6513-XL-FWM-K9
|
Cisco Catalyst 6513 Firewall Security System with Enhanced Chassis, Supervisor 720 3BXL and one Firewall Service Module
|
|
Software
|
|
SC-SVC-FWM-1.1-K9
|
Firewall Services Module Software Release 1.1 for Cisco Catalyst 6500 and 7600 Series
|
|
SC-SVC-FWM-1.1-K9=
|
Firewall Services Module Software Release 1.1 for Cisco Catalyst 6500 and 7600 Series (spare)
|
|
SC-SVC-FWM-2.2-K9
|
Firewall Services Module Software Release 2.2 for Cisco Catalyst 6500 and 7600 Series
|
|
SC-SVC-FWM-2.2-K9=
|
Firewall Services Module Software Release 2.2 for Cisco Catalyst 6500 and 7600 Series (spare)
|
|
SC-SVC-FWM-2.3-K9
|
Firewall Services Module Software Release 2.3 for Cisco Catalyst 6500 and 7600 Series
|
|
SC-SVC-FWM-2.3-K9=
|
Firewall Services Module Software Release 2.3 for Cisco Catalyst 6500 and 7600 Series (spare)
|
|
SC-SVC-FWM-3.1-K9
|
Firewall Services Module Software Release 3.1 for Cisco Catalyst 6500 and 7600 Series
|
|
SC-SVC-FWM-3.1-K9=
|
Firewall Services Module Software Release 3.1 for Cisco Catalyst 6500 and 7600 Series (spare)
|
|
SC-SVC-FWM-3.2-K9
|
Firewall Services Module Software Release 3.2 for Cisco Catalyst 6500 and 7600 Series
|
|
SC-SVC-FWM-3.2-K9=
|
Firewall Services Module Software Release 3.2 for Cisco Catalyst 6500 and 7600 Series (spare)
|
Note: Cisco Firewall Services Module Software 1.1 has reached end-of-sale status. Customers are encouraged to upgrade or purchase FWSM Software 2.3 or 3.1, 3.2.
Context License Part Numbers
|
Part Number
|
Description
|
|
FR-SVC-FWM-VC-T1
|
20 virtual firewall licenses for Cisco FWSM Software 2.2 or above
|
|
FR-SVC-FWM-VC-T2
|
50 virtual firewall licenses for Cisco FWSM Software 2.2 or above
|
|
FR-SVC-FWM-VC-T3
|
100 virtual firewall licenses for Cisco FWSM Software 2.2 or above
|
|
FR-SVC-FWM-VC-T4
|
250 virtual firewall licenses for Cisco FWSM Software 3.1 or above
|
|
FR-SVC-FWM-UPGR1
|
Upgrade from 20 to 50 virtual firewalls for Cisco FWSM Software 2.2 or above
|
|
FR-SVC-FWM-UPGR2
|
Upgrade from 50 to 100 virtual firewalls for Cisco FWSM Software 2.2 or above
|
|
FR-SVC-FWM-UPGR3
|
Upgrade from 100 to 250 virtual firewalls for Cisco FWSM Software 3.1, 3.2
|
