Can the CSM operate in a FWLB situation where only one Catalyst 6500 or only one CSM is used for the “sandwich”?
A. Yes, this can be accomplished with the CSM. While in most cases best practices recommend connecting the outside and inside interfaces of FWs to physically distinct devices, there are situations where customers want to use VLANs for separate security domains or firewalls that are connected to a single switch on both secure and non-secure links, thereby relying much more on the switch security. If there are no concerns with issues relating to using VLANs to separate security domains then the single-box CSM FWLB solution is a viable option. The CSM is capable of performing both “halves” of the sandwich within a single box. In fact, the CSM can perform the entire solution with one blade if you choose to do so. Another may be needed for redundancy.
