I'm in the process of reconfiguring my 1800f v7.12 to a firewall on a stick topology. The new configuration will only have 2 active physical ports that connect to CORE1 and CORE2 switches. The CORE switches have a physical connection to the Edge router. I'm using BGP for the routing and that seems to be working.
Each active port have 2 sub interfaces, a trusted VLAN and an untrusted VLAN.
My issue is the trying to modify my current FW policies. The inside to outside seems to be working fine. However, I do need several policies that allow for my DMZ traffic to hit certain IPs on the inside. With only a trusted and untrusted ports to choose from I'm confused as to what that policy would look like. Technically, now my inside IPs and my DMZ IPs are considered inside addresses.
BTW, the CORE switches forward all my DMZ subnet to the FW. The gateway for the DMZ subnet is the FW. I have no static routes, its all BGP.