topic Using a Transparent Firewall in Network Security

Using a Transparent Firewall

WILLIAM STEGMAN — Mon, 11 Mar 2019 23:03:53 GMT

How does a transparent firewall intercept traffic in order to inspect and filter it? I'm not clear on the physical makeup of the design. If I have a vlan with some hosts I want to protect and connect the inside and outside interfaces of an ASA to the same VLAN, how does the ASA get in between those hosts I want to protect, other hosts on the same VLAN, and their default gateway in the same VLAN? From a cabling perspective I would only be connecting cables of the ASA and the hosts to a switch port that is in a common VLAN. Why would a host go through the firewall? Since it's all layer 2, wouldn't it have to be ARP? I've looked at the ARP scenarios in documentation, but none of it appears to state the firewall proxys ARP in some fashion.

thank you

Bill

Using a Transparent Firewall

Maykol Rojas — Tue, 08 May 2012 16:20:20 GMT

Hello Bill,

That is exactly where it goes wrong, you dont have to connect everything on the same vlan, it would be two different logical vlans carrying Layer 2 traffic but with the same IP scheme. For example, consider the following scenario:

Vlan100

192.168.100.0

Inside network---------------Switch----------------Router--------Internet

Now, the main Idea of the ASA firewall is to be inserted on this scenario without having to change the IP scheme, so here is what you do

Vlan100 Vlan101

192.168.100.0 192.168.100.1

Inside network---------------ASA_Firewall------------------Router------Internet

What the ASA is going to do is to bridge packets between the inside network and the router, how? It creates its own mac address table just like a switch and forwards the packets on a layer 2 basis, he knows that the mac-address of the router is located on the outside and the mac address of the inside host is on the inside, so when a requests is going to the mac-address of the router it picks up the packet and it bridges it to the router.

Hope it helps.

Mike

Using a Transparent Firewall

WILLIAM STEGMAN — Tue, 08 May 2012 17:13:02 GMT

ahh, that makes sense. Thank you very much.

Using a Transparent Firewall

Mery — Fri, 21 Feb 2014 13:40:23 GMT

Hello All,

That is a very good explanation , BUT if i use the same vlan for inside and outside interface of a transparent firewall will it work. so the physical diagram is as below:

vlan100 vlan100

servers-------------------Inside-Interface-FIREWALL-Outside-Interface------------------------Router

The firewall will bridge the two interfaces on the same vlan, so basically it will lear the mac address of both side, or it won't?

Mery