topic Re: Transparent mode and failover. in Network Security

Transparent mode and failover.

pauloroque — Mon, 11 Mar 2019 12:30:14 GMT

Does an ASA in both transparent mode and standby state pass any type of traffic?

Paulo Roque

Network Engineer

Re: Transparent mode and failover.

Thu, 17 Apr 2008 20:39:21 GMT

Transparent firewall mode allows only two interfaces to pass through traffic; however, on the ASA adaptive security appliance, you can use the dedicated management interface (either the physical interface or a subinterface) as a third interface for management traffic. The mode is not configurable in this case and must always be management-only

Re: Transparent mode and failover.

mvandorp — Mon, 21 Apr 2008 07:19:13 GMT

In transparent mode, all allowed traffic is passed, but only IP-traffic can be inspected. Normally BPDUs are blocked, but you want them through if using STP.

In transparent failover mode, you definitely want STP, to eliminate problems when both FWs become active (should never happen, but...).

In standby mode, the FW does not pass any traffic.

There is a failover link between active and standby FW, to carry FW status info. If you do stateful failover, the state-info is transferred too (on it's own VLAN). This is management traffic, no user data!

I don't know about ASA, but an FWSM allows up to 8 BVI-groups per context. An inside VLAN is connected to an outside VLAN by the transparent FW (this is called a BVI-group). Each BVI-group is completely isolated from each other. You need a router to get traffic between the BVI groups.

Thr management interface is just for that. It also can carry traffic for AAA (eg. a connection to the radius server).

HTH,

Marcel