ASA 5510 Transparent or Routed mode

[Alcides Miguel]

Hi all,

I have introduced a Cisco ASA to my Network so can someone explain me what is best operation mode for the  security appliance?

the pros 'nd cons.

INTERNAL---->PROXY----->ASA5510------>Router----->INTERNET

Best Regards

Alcides

[varrao]

Hi Alcides,

No one could be a better judge of it than you yourself, if you need further in depth info about transparent mode, kindly go through the doc:

http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps2030/products_configuration_example09186a008089f467.shtml

Also clearly go through the unsupported features of Transparent mode, this might be important for your requirement.

Hope this helps.

Thanks,

Varun

[Alcides Miguel]

Hi Varun, thanks for your response. But the link you provided is forbidden for me. But in your opinion what's is the best operation mode thinking in security pespective?

like a frontend-backend firewall topology

Best Regards,

Alcides

[varrao · Accepted solution]

Hi Alcides,

The transparent does not support the following features:

• NAT /PAT

  Starting with ASA/PIX 8.0(2), NAT/PAT is supported in the transparent firewall.

• Dynamic routing protocols (such as RIP, EIGRP, OSPF)

• IPv6

• DHCP relay

• Quality of Service (QOS)

• Multicast

• VPN termination for through traffic


So if you have any of the above requirements that would not be supported in transparent firewall.

Moreover I guess routed mode would be better, but then again, as I said earlier, you are the best judge in this scenario.

Please find the document attached.

Hope this helps.

Thanks,
Varun

[Alcides Miguel]

HI Varun,

Many thanks your attention was very helpfully. so as you can see I'm new to ASA products. one last question what about the double Nat? many people just ask me about this( doing Nat in ASA and after in router) is there any problem doing that?

Best Regards,

Alcides

[varrao]

Hi Alcides,

If you are using the firewall in routed mode, y wud you do double nat, just do natting once on the ASA itself and routing on the router but if you are using the firewall in transparent mode then you would need to do natting on the router only.

Hope this helps.

Thanks,

Varun