ASA Transparent mode multicast traffic in 8.2 and 8.4

[Mahesh Pratap Singh]

Hi,

When i configure 8.2 in trasparent mode and deploy the a network that was wrok on EIGRP after that i found the neighborship was stop when i allow the mutlicast address and prtocol on outside interface it was start the working But when i deploy an ASA with 8.4 IOS and then allow the multicast address and protocol both the interface (Inside and outside) after that it was start working.

So i want to know that what the reasion to allow multicast address and protocol on 8.4 IOS for both interface. I am not able to find any answer for this.

[Poonam Garg]

Hi Mahesh,

By default ASA in transparent mode do not allow any packets not having a valid EtherType greater than or equal to 0x600. As per my knowledge this concept remain same for all versions of ASA. Most control plane protocols are denied.

ASA in transparent mode only allows ARP, broadcast traffic, TCP and UDP inspected unicast traffic.

For EIGRP to work through transparent firewall, we need to open ACLs in both direction for multicast and unicast both type of EIGRP traffic on all versions of ASA Firewall.

[Mahesh Pratap Singh]

Hi Poonam,

When we assign Mgmt IP address of transparent mode in  8.2 and BVI interface IP in 8.4 after that we see that ARP packet is allow its EtherType 0x806 and IP packet is also allow EtherType 0x800 without any ACL. As per you it  is not allowed EtherType greater than or equal to 0x600.

[Poonam Garg]

Hi Mahesh,

As per my statement, By default ASA in transparent mode do not allow any packets not having a valid EtherType greater than or equal to 0x600. Your findings are exactly the same..

Please do rate helpful posts.