topic Hi, in Network Security

Firewall mode of operation

Serpent2010 — Tue, 12 Mar 2019 07:55:54 GMT

Hi,

My question sounds to be a fundamental question, however, I am looking for the expert advise.

It is known that Transparent Firewall will be faster (no IP address) but less protection on other hand Static/Dynamic packet filtering, Application-layer, or Circuit-level will be slower but more protection.

Based on these facts, I would like to get an advise which mode is preferred considering security is higher priority than complexity (creating an internal subnet(s)).

Please, I will need to know what I will gain/loss with each mode configuration.

Thanks,

Hi,

ankojha — Wed, 22 Jun 2016 15:16:48 GMT

Hi,

As per your query, there is no preferred mode but it all depends on how your deployment

is going to be. There are some features which are not supported in transparent mode

but it has advantage in the sense that it doesn't changes your existing network if deployed in the network. You can follow the below document to check features which you need to prefer according to your requirement :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/intro-fw.html

rate if it Helps.

Thanks,

Ankita

Thank you for your reply.

Serpent2010 — Wed, 22 Jun 2016 22:40:27 GMT

Thank you for your reply.

But how about if I have on two different physical interfaces two different inside subnets (e.x.172.x.x.x & 10.x.x.x), would the Transparent mode be bale to handle this scenario?

As I know, in transparent mode all interfaces (insides and outside) shall be on same subnet.

Hi,

ankojha — Thu, 23 Jun 2016 06:17:25 GMT

Hi,

In that case, you don't need transparent mode and can go for routed mode.

Rate if it helps.

Thanks,

Ankita