Home > Articles > Cisco Certification > Understanding Cisco Secure Firewall Services Module 4.x Routing and Feature Enhancements

Understanding Cisco Secure Firewall Services Module 4.x Routing and Feature Enhancements

Chapter Description

This chapter discusses the key additions to the Cisco Secure Firewall Services Module (FWSM) 4.x code.

Miscellaneous Security Features

DHCP option 82 is typically used in service-provider networks. It adds location information that can be used to differentiate services between customers. A filtering enhancement was also added to support HTTPS with SmartFilter.

Dynamic Host Configuration Protocol Option 82

Option 82 provides location information from the Dynamic Host Configuration Protocol (DHCP) relay agent—in this case, the FWSM to the DHCP server. This information can be used to differentiate DHCP clients, consequently offering distinctive services on a client basis.

You can use two commands to enable DHCP relay. The first command specifies the DHCP server IP address and the interface where it is located. Optionally, the dhcprelay server ip_address command can be configured under the outgoing interface. The second line enables clients on the inside interface to send and receive DHCP information.

FWSM/Context-A(config)# dhcprelay server 10.20.100.25 Outside
FWSM/Context-A(config)# dhcprelay enable Inside

Option 82 can then be enabled on a specific interface, as shown by the following two commands:

FWSM/Context-A(config)# interface vlan vlan-number
FWSM/Context-A(config-if)# dhcprelay information trusted

Option 82 can also be enabled on all interfaces using the global command that follows:

FWSM/Context-A(config)# dhcprelay information trust-all

If you are currently using the FWSM as a DHCP relay agent, the addition of option 82 will be a simple addition. Also, when enabling option 82 globally, all interfaces are trusted except the interface that is configured as the dhcprelay (outgoing) interface.

DHCP option 82 adds location information to clients, which can be used to differentiate services. Although used primarily in service provider networks, it could all be used in enterprise networks to differentiate client services.

Smartfilter HTTPS Support

For those of you looking for HTTPS support from SmartFilter on the FWSM, it has now arrived with the introduction of 4.01. See Chapter 14, "Filtering," for configuration details.