CISCO CATALYST 6500 SERIES FIREWALL SERVICES MODULE FOR CISCO CATALYST 6500 SERIES AND CISCO 7600 SERIES

Transcription

1 DATA SHEET CISCO CATALYST 6500 SERIES FIREWALL SERVICES MODULE FOR CISCO CATALYST 6500 SERIES AND CISCO 7600 SERIES Figure 1. Cisco Catalyst 6500 Series Firewall Services Module The Cisco Catalyst 6500 Series Firewall Services Module (FWSM), a high-speed, integrated firewall module for Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers, provides 5.5 Gbps throughput, 100,000 connections per second, and 1 million concurrent connections. Up to four FWSMs can be installed in a single chassis, providing scalability to 20 Gbps per chassis. As part of the Cisco PIX family of security appliances, the FWSM provides large enterprises and service providers with superior security, reliability, and performance. The FWSM uses Cisco PIX technology and runs the Cisco PIX OS, a real-time, hardened, embedded system that eliminates security holes and performance-degrading overhead. At the heart of the system, a protection scheme based on the Adaptive Security Algorithm (ASA) offers stateful connection-oriented firewalling. Using ASA, the FWSM creates a connection table entry for a session flow based on the source and destination addresses, randomized TCP sequence numbers, port numbers, and additional TCP flags. The FWSM controls all inbound and outbound traffic by applying the security policy to these connection table entries. The FWSM includes many advanced features like multiple security contexts both at the routed levels and in bridging mode, helping to reduce cost and operational complexity while managing multiple firewalls from the same management platform. The virtualization on the FWSM reinforces the investment protection provided on Cisco Catalyst 6500 Series switches and 7600 Series routers. FWSM virtualization, when combined with other security services within the Cisco Catalyst 6500 Series Switch or Cisco 7600 Series Router, presents a powerful defense in-depth solution. Using features like Resource Manager, organizations can limit the resources allocated to any security context at any time, which helps to ensure that one security context does not interfere with another. With the default software license, up to two security contexts can be run, in addition to a special admin context. For more security contexts, a license must be purchased. Using the transparent firewall feature, which configures the FWSM to act as a Layer 2 bridging firewall, there are minimal changes required to the network topology. The use of a transparent firewall reduces both the configuration and deployment time---a definite plus for any business with limited IT resources. There are no IP addresses except the management interface; no subnetting or configuration updates are required with transparent firewalls. The FWSM Services Management and Enhanced Resource Management and Limiting features more effectively provision and monitor security services, even within and across multiple virtual contexts. This includes class creation, resource limiting, per-user/cisco Access Control Server (ACS)-based access control lists (ACLs), syslogs per ACL, syslog level configuration, Address Resolution Protocol (ARP) inspection, and multicast pass-through support. All contents are Copyright Cisco Systems, Inc. All rights reserved. Important Notices and Privacy Statement. Page 1 of 11

2 Enhanced filtering provides extended protection and application support, such as voice applications. It also includes policy-based Network Address Translation (NAT), bidirectional NAT, bidirectional ACLs, voice over IP (VoIP) enhancements, Port Address Translation (PAT) for skinny and Session Initiation Protocol (SIP), Media Gateway Control Protocol (MGCP), H.323 v3 and v4, Multiprotocol Label Switching (MPLS) and firewall integration, URL filtering with WebSense and N2H2, and shunning and blocking attacks. FIREWALL SERVICES MODULE BENEFITS The traditional role of firewalls has changed. Today s firewalls do more than protect a corporate network from unauthorized external access. Besides protecting the perimeter of the corporate network from threats, firewalls can also prevent unauthorized users from accessing a particular subnet, workgroup, or LAN within a corporate network. The cost of not building a layered, defense-in-depth system can be devastating. In the United States alone in 2003, the overall reported corporate loss due to theft and insider abuse totaled 82 million dollars (CSI/FBI Report, 2003). FBI statistics indicate that 70 percent of all security problems originate from inside an organization. According to one in five respondents to the FBI s survey, intruders broke into, or tried to break into, their corporate networks during the preceding 12 months and most experts agree that the majority of network break-ins go undetected. Corporate networks need a reliable, integrated security solution to protect their business assets from these increasing threats. Integrated Module Installed inside a Cisco Catalyst 6500 Series Switch or Cisco 7600 Series Router, the FWSM allows any port on the switch to operate as a firewall port and integrates stateful firewall security inside the network infrastructure. This becomes especially important where rack space is at a premium. Cisco Catalyst 6500 Series switches and Cisco 7600 Series routers truly emerge as the IP services switch of choice for customers requiring intelligent services such as firewall services, intrusion detection, and VPN, along with multilayer LAN, WAN, and MAN switching capabilities. Ready for the Future The FWSM can handle up to 5.5 Gbps of traffic, providing superior performance to meet future requirements without requiring a system overhaul. Up to three additional FWSMs (a total of four modules) can be added to the Cisco Catalyst 6500 Series to meet growing demands. Reliability and High Availability The FWSM is based on Cisco PIX technology and uses the time-tested Cisco PIX OS, a secure, real-time operating system. The FWSM offers a unique combination of performance and security on the same platform, using proven Cisco PIX technology for inspecting packets. For resiliency, the FWSM supports high-speed failover between modules within a single 6500 or 7600 chassis and between modules in separate chassis. This support of both intra-chassis and inter-chassis failover offers customers complete flexibility in their firewall deployments. Lower Cost of Ownership The FWSM offers the best price-performance ratio of any firewall. Because the FWSM is based on the Cisco PIX firewall, the cost of training and management is lower; because the FWSM is integrated in the chassis, there are fewer boxes to manage. Ease of Management The Cisco PIX Device Manager s intuitive GUI can be used to manage and configure the features within the FWSM. The FWSM is supported by the Cisco management framework and for configuration and monitoring by Cisco AVVID (Architecture for Voice, Video and Integrated Data) partners. The Cisco PIX Device Manager allows simplified management and monitoring of the FWSM at the system and device level, as well as at the more detailed security context level. Page 2 of 12

3 The FWSM is also manageable from a central console using the scalable CiscoWorks VPN/Security Management Solution (VMS). CiscoWorks VMS provides a modular approach to managing and monitoring security solutions throughout a Cisco network. Integrated, extensible management centers are available for several solutions, including VPNs, routers, switches, firewall, and Cisco security agents. In particular, the CiscoWorks Management Center for Firewalls supports centralized, comprehensive firewall administration of FWSMs, Cisco PIX security appliances, and Cisco IOS router-based firewalls throughout the network in a consistent, uniform manner to best expedite large security deployments. FWSM KEY FEATURES Table 1. Features and Details Features Performance Details 5.5 Gbps 1 million concurrent connections 100,000 connection setup and teardowns per second 256,000 PAT and 256,000 NAT translations Routed and Transparent Firewall The firewall can run in one of the following modes: Routed---The FWSM is considered to be a router hop in the network. Transparent---The FWSM acts like a bump in the wire and is not a router hop. The FWSM connects the same network on its inside and outside ports, but each port must be on a different VLAN. No dynamic routing protocols or NAT are required. Multiple Security Contexts Bidirectional NAT and Policy-based NAT Resource Management Same Security Level Communication Cut-Through Proxies URL Filtering In multiple-context mode, you can create up to 100 separate security contexts (depending on your software license). A security context is a virtual firewall that has its own security policy and interfaces. Each context can support 256 VLANs in routed mode. Transparent mode supports only two interfaces per context. Multiple contexts are similar to having multiple standalone firewalls. All security contexts can be run in routed mode or in transparent mode Provides dynamic/static NAT and PAT You can configure NAT on inside and outside addresses. For Policy-based NAT, you can identify addresses to be translated using an extended ACL, which allows you more control in determining which addresses to translate. Allows limiting of resources per context, so one context does not use up all the resources. Allows interfaces which share the same security level to communicate without NAT/STATIC policies. Per-host maximum connection limit can be enforced. Enforces high performance user-authentication policies on a per-vlan basis for TCP, HTTP, FTP, HTTPS, and others. Filter HTTP, HTTPS, and FTP requests using WebSense Enterprise or HTTP filtering by N2H2 (now part of Secure Computing Corporation). Page 3 of 12

4 Features Configuration Support AAA Support Cisco PIX Device Manager Secure Network Management Access Lists Details Console to command-line interface (CLI) (session from switch) Telnet to the inside interface of the FWSM Telnet over IP Security (IPSec) to the outside interface of the FWSM Secure Shell Protocol (SSH) to CLI Secure Sockets Layer (SSL) to Cisco PIX Device Manager CiscoWorks VMS Management Center for Firewalls Integrates with popular authentication, authorization, and accounting (AAA) services through TACACS+ and RADIUS support Simple, intuitive, Web-based GUI supports remote firewall management Numerous real-time and historical reports providing usage trend, performance baseline, and security event information Cisco PIX Device Manager is also integrated with an overall device management tool for the Cisco Catalyst 6500 Series---CiscoView Device Manager. From CiscoView Device Manager, modules within the Cisco Catalyst 6500 system, such as the FWSM and the supervisor module, can be managed collectively through an easy-to-use GUI. Secure, Triple Data Encryption Standard (3DES)-encrypted network management access Up to 80,000 ACLs The following ACLs types are supported: Extended ACL to control IP traffic on an interface: Inbound Outbound For transparent firewall mode, EtherType ACL to control non-ip traffic on an interface: Inbound Outbound Standard ACL for Open Shortest Path First (OSPF) route redistribution Per-user Cisco Secure ACS-based ACLs Dynamic Routing Protocols In single-context mode, the FWSM supports the following routing protocols. Routing Information Protocol (RIP) v1 and v2 (passive mode) OSPF Transparent mode supports static routing only Command Authorization Object Grouping Allows you to control user access to commands and to create user accounts or logins tied to privilege levels Ability to group network objects (hosts, for example) and services (FTP and HTTP) for ACLs Page 4 of 12

5 Features Protection from Denial of Service (DoS) ARP Inspection Dynamic Host Control Protocol (DHCP) High Availability Logging Details DNS Guard Flood Defender Flood Guard TCP Intercept with SYN cookies optimization Unicast Reverse Path Forwarding (urpf) Mail Guard FragGuard and Virtual Reassembly Internet Control Message Protocol (ICMP) stateful inspection User Datagram Protocol (UDP) rate control For transparent firewall mode, the FWSM compares the MAC address and IP address in all ARP packets to static entries in the ARP table. The FWSM acts as a DHCP server. The FWSM also supports DHCP relay to forward DHCP requests to an upstream router. Active-standby stateful failover---intra-chassis and inter-chassis Comprehensive syslogging, FTP, URL, and ACL logging Additional Protocols H.323 v3 and 4 NetBios over IP RAS Version 2 Real-Time Streaming Protocol (RTSP) SIP with PAT XDMCP Skinny EXAMPLE FWSM DEPLOYMENTS The FWSM can be deployed in topologies serving enterprise campuses, data centers, or service providers. Today s enterprises need more than just perimeter security---they need to connect business partners and provide campus security domains that serve multiple groups within these organizations. The FWSM provides a flexible, cost-effective, and performance-based solution by allowing users and administrators to establish security domains with different policies within the organization. Figure 2 shows a campus deployment using stateful filtering to establish separate VLAN-based security domains. Page 5 of 12

6 Figure 2. Campus Deployment Using the FWSM, users can set appropriate policies for different VLANs. Data centers also require stateful firewall security solutions to protect data while delivering gigabit performance at the lowest possible cost. Figure 2 shows a data center with redundant FWSMs protecting server data. Page 6 of 12

7 Figure 3. e-commerce Data Center Deployment The FWSM maximizes capital investment by providing the best price-performance ratio in a firewall, and allows customers to replace expensive multiple firewalls that require additional firewall load balancer devices. Figure 4. Multiple Context Deployment Page 7 of 12

8 In multiple context mode, each firewall runs its own policies, its own management domain, and its own syslogging; in essence, providing a completely independent security domain. Virtual firewall security contexts configured with their own policies are functionally similar to a collection of independent physical firewalls, but also provide ease of management. Virtualization makes it easier to add or delete security contexts based on subscriber growth. This helps in costs savings through lower deployment costs, as organizations do not need to deploy multiple devices yet are able to achieve the same capabilities and maintain complete control of configuration, management, and provisioning of security contexts. Service providers can offer security contexts to individual customers, while enterprises can assign a security context to each department or division. ORDERING INFORMATION Table 2. Firewall Services Module Hardware and Software Part Numbers Product Number Description Hardware WS-SVC-FWM-1-K9 WS-SVC-FWM-1-K9= Firewall Services Module for Cisco Catalyst 6500 and 7600 Series Firewall Services Module for Cisco Catalyst 6500 and 7600 Series (spare) Software SC-SVC-FWM-1.1-K9 SC-SVC-FWM-1.1-K9= SC-SVC-FWM-2.2-K9 SC-SVC-FWM-2.2-K9= SC-SVC-FWM-2.3-K9 SC-SVC-FWM-2.3-K9= Firewall Services Module Software Release 1.1 for Cisco Catalyst 6500 and 7600 Series Firewall Services Module Software Release 1.1 for Cisco Catalyst 6500 and 7600 Series (spare) Firewall Services Module Software Release 2.2 for Cisco Catalyst 6500 and 7600 Series Firewall Services Module Software Release 2.2 for Cisco Catalyst 6500 and 7600 Series (spare) Firewall Services Module Software Release 2.3 for Cisco Catalyst 6500 and 7600 Series Firewall Services Module Software Release 2.3 for Cisco Catalyst 6500 and 7600 Series (spare) LICENSING Table 1 lists the part numbers that are needed when ordering security context licenses. Cisco supports three tiers of licenses. To be able to order any of these license tiers, you must be running FWSM Software Release 2.2(1) or later. No changes in hardware are required when upgrading from FWSM Software Release 1.1 to Release 2.2 and 2.3. Table 3. Context License Part Numbers PART NUMBER FR-SVC-FWM-VC-T1 FR-SVC-FWM-VC-T2 FR-SVC-FWM-VC-T3 DESCRIPTION 20 virtual firewalls 50 virtual firewalls 100 virtual firewalls Page 8 of 12

9 Table 4 lists upgrade part numbers. Table 4. Upgrade Part Numbers PART NUMBER FR-SVC-FWM-UPGR1 FR-SVC-FWM-UPGR2 DESCRIPTION Upgrade from 20 to 50 virtual firewalls Upgrade from 50 to 100 virtual firewalls SYSTEM REQUIREMENTS Cisco Catalyst 6500 Series Supervisor Engine 2 with Multilayer Switch Feature Card 2 (MSFC2) or Cisco Catalyst 6500 Series Supervisor Engine 720 Native Cisco IOS Software Release 12.1(13)E or later. If you are running a Supervisor Engine 720, you will need Cisco IOS Software Release 12.2(14)SX or later Hybrid Cisco Catalyst OS Software Release 7.5(1) or later. If you are using a Supervisor Engine 720, you will need a minimum of Cisco Catalyst OS Software Release 8.2 If you intend to use the multi-svi feature, you will need Cisco IOS Software Release 12.2(20)E or later for native Cisco IOS Software, and for Cisco Catalyst OS software you will need version 7.(6) or later Occupies one slot in a Cisco Catalyst 6500 Series Switch or Cisco 7600 Series Router Up to four firewall modules may be deployed in the same chassis FOR MORE INFORMATION For more information about the Cisco FWSM Software Release 2.3, contact your local account representative or visit: To obtain additional information about Cisco security solutions, visit: Cisco Self-Defending Networking Strategy: Cisco Threat Defense System: Cisco Integrated Security Solutions: HARDWARE SPECIFICATION Weight: 10 pounds Power Consumption: watts REGULATORY COMPLIANCE Safety UL 1950 CSA C22.2 No EN60950 EN TS001 CE Marking IEC AS/NZS3260 Page 9 of 12

10 EMI FCC Part 15 Class A ICES-003 Class A VCCI Class B EN55022 Class B CISPR22 Class B CE Marking AS/NZS3548 Class B NEBS SR NEBS: Criteria Levels (Level 3 compliant) GR-63-CORE---NEBS: Physical Protection GR-1089-CORE---NEBS: EMC and Safety ETSI ETS Switching Equipment Telecommunications ITU-T G.610 ITU-T G.703 ITU-T G.707 ITU-T G.783 Sections 9-10 ITU-T G.784 ITU-T G.803 ITU-T G.813 ITU-T G.825 ITU-T G.826 ITU-T G.841 ITU-T G.957 Table 3 ITU-T G.958 ITU-T I.361 ITU-T I.363 ITU I.432 ITU-T Q.2110 ITU-T Q.2130 ITU-T Q.2140 ITU-T Q.2931 ITU-T O.151 ITU-T O.171 ETSI ETS TAS SC BISDN (1998) ACA TS 026 (1997) BABT /TC/139 (Draft 1e) Page 10 of 12

11 Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax: European Headquarters Cisco Systems International BV Haarlerbergpark Haarlerbergweg CH Amsterdam The Netherlands www-europe.cisco.com Tel: Fax: Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: Fax: Asia Pacific Headquarters Cisco Systems, Inc. 168 Robinson Road #28-01 Capital Tower Singapore Tel: Fax: Cisco Systems has more than 200 offices in the following countries and regions. Addresses, phone numbers, and fax numbers are listed on the Cisco Website at Argentina Australia Austria Belgium Brazil Bulgaria Canada Chile China PRC Colombia Costa Rica Croatia Cyprus Czech Republic Denmark Dubai, UAE Finland France Germany Greece Hong Kong SAR Hungary India Indonesia Ireland Israel Italy Japan Korea Luxembourg Malaysia Mexico The Netherlands New Zealand Norway Peru Philippines Poland Portugal Puerto Rico Romania Russia Saudi Arabia Scotland Singapore Slovakia Slovenia South Africa Spain Sweden Switzerland Taiwan Thailand Turkey Ukraine United Kingdom United States Venezuela Vietnam Zimbabwe Copyright 2005 Cisco Systems, Inc. All rights reserved. CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iquick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iq Expertise, the iq logo, iq Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post- Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, TeleRouter, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or Website are the 2005 property Cisco of Systems, their respective Inc. owners. All rights The use reserved. of the word partner does not imply a partnership relationship between Cisco and any other company. Important (0502R) notices, privacy statements, and trademarks of Cisco Systems, Inc. can be found on cisco.com x_ETMG_KL_4.05 Page 11 of 12 Printed in the USA

12 Page 12 of 12