Re: Layer 3 and Firewall

Hi, do you have the possibilities to configure something like ping alive in 
some or all firewall’s interface , and in case somebody disconnect some 
interface of the firewall send you  an alert or something like that, at least 
you will know is some cable of your box was unplugged or take out..   or put a 
redundance  box, but in this case you will need two Fws and more ports on the 
switch to connected,  in this case if somebody disconnect some firewall‘s 
interface all  the traffic become to the other box and send you an alarm too…



----- Mensaje original -----
De: dubaisans dubai <dubaisans@gmail.com>
Fecha: Miércoles, Octubre 4, 2006 12:14 pm
Asunto: Layer 3 and Firewall

> Hi,
>
> Is it a REALLY BAD idea to have multiple Firewall segments connected
> on the same 6509?
>
> I have a 6509 Layer 3 switch which connects the LAN , WAN and Server
> segment. This has three Layer 3 VLANs
>
> I plan to implement a Firewall [ either PIX or checkpoint] which will
> segregate  these 3 segments.
>
> On the Cisco 6509 I will convert the existing Layer 3 VLANs into Layer
> 2 and assign those IP[which is the default gateway for the respective
> segments] to the 3 interfaces of the Firewall.
>
> Firewall is managed by me[Infosec dept] while the switch is 
> managed by
> Networking dept.
>
> My worry is - After i implement Firewall , if the network admin pulls
> out the Firewall cables and brings back the Layer 3 VLANs with those
> IPs then there is no Firewall.
>
> How can we tackle this risk ?
>
> What is the technical workaround. Is it a REALLY BAD idea to have
> multiple Firewall segments connected on the same 6509?