ASA Transparent Mode Configuration

[mhcnetadmin]

Hi all,

I am new to ASA, and I need some help in configuring ASA in transparent mode :

this is what I've done so far:

conifgured tow interfaces as inside and outside, configured global IP address from the same subnet , configured default route

I read that by default traffic from higher security level interface to lower security level interface is allowed by default, so I did't cofigure access list for this traffic, but I can't ping anything from the inside lan to the outside. so do I need to configure access list for the icmp and other traffic? what other things should I bay attention too in Transparent mode other that it doesn't support dynamic routing?

Thanks.

[sean_evershed]

Hi,

To allow ping through your firewall you will need to configure ICMP inspection or an access-list. See below:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

See below a configuration guide for transparent firewalls. It doesn't support QoS either for example.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008089f467.shtml

Please remember to rate all posts that are helpful.

[mhcnetadmin]

Ahhhhhhhhhhhh,  thanks alot, but other traffic is permitted in Transparent mode without access list right??

[sean_evershed]

The answer is that it depends on the type of traffic.You will need an ACL or enable application inspection for applications that embed IP addressing  information in the user data packet or open secondary channels on  dynamically assigned ports.

See below a configuration example for TFTP and FTP.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807ee585.shtml

See also a configuration guide for application inspection for version 8.2

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/inspect_overview.html

Thanks for the rating.

[mhcnetadmin]

Thanks

I will try it tomorrow.