topic You don't actually mention in Network Security

Transparent Firewall Issue

Kyle Smith — Tue, 12 Mar 2019 07:22:46 GMT

Hello,

I recently attempted placing an ASA in my environment in transparent mode to replace a Juniper transparent firewall and ran into some issues. The way my network is designed is I have a router with the default gateway for all the networks behind the firewall, my transparent firewall, and then a switch with 3 vlans on it all on the same /24 network.

When I tried cutting over to the ASA we were unable to test any rules. I tried checking the log viewer in ASDM but didnt see any traffic hitting the firewall. Is this normal behavior for the ASA in transparent mode? Also, not all devices appeared to be in my arp table which had me a bit concerned.

Guess I am just trying to figure out what isn't working and why. Since ASDM wasnt showing any traffic in the log viewer I couldnt do much.

I can post example configs if anyone would feel it would be helpful.

Thanks,

You just need to turn the

Philip D'Ath — Tue, 23 Feb 2016 09:12:49 GMT

You just need to turn the logging up if you want to see it in the ASDM. Try:

logging asdm informational

You don't actually mention

Philip D'Ath — Tue, 23 Feb 2016 09:13:23 GMT

You don't actually mention anything that didn't work.

Philip,

Kyle Smith — Tue, 23 Feb 2016 11:40:52 GMT

Philip,

Thank you for your reply. My apologies, so what we had the testing team do is try and test the ACL logic based on what they previously were able to do with the Juniper firewall in place. I have 4 named interfaces; Outside, InsideA, InsideB, and InsideC. They tried to SSH to a few machines from the Outside to InsideA and weren't able to. From there, they tried other tests but nothing seemed to work.

I jumped on ASDM to check the logging and I set the level to debugging to see everything. When I did, I didnt see any traffic hit the firewall which had me concerned.

My interfaces are set up as such:

interface Gig0/0
nameif Outside
bridge-group 10
security-level 80
!
interface Gig0/1
nameif InsideA
bridge-group 10
security-level 80
!
interface Gig0/2
nameif InsideB
bridge-group 10
security-level 80
!
interface Gig0/3
nameif InsideC

bridge-group 10
security-level 80

interface BVI10
ip address 192.168.1.10

From my guess, traffic should flow to my ASA without me needing to add much more. At this point I should see traffic being allowed/denied.

Try adding the below as well.

Philip D'Ath — Tue, 23 Feb 2016 19:06:00 GMT

Try adding the below as well. It should definitely be showing up.

logging trap informational