Firewall mode of operation

[Serpent2010]

Hi,

My question sounds to be a fundamental question, however, I am looking for the expert advise.

It is known that Transparent Firewall will be faster (no IP address) but less protection on other hand Static/Dynamic packet filtering, Application-layer, or Circuit-level will be slower but more protection.

Based on these facts, I would like to get an advise which mode is preferred considering security is higher priority than complexity (creating an internal subnet(s)).

Please, I will need to know what I will gain/loss with each mode configuration.

Thanks,   

[ankojha · Accepted solution]

Hi,

As per your query, there is no preferred mode but it all depends on how your deployment 

is going to be. There are some features which are not supported in transparent mode

but it has advantage in the sense that it doesn't changes your existing network if deployed in the network. You can follow the below document to check features which you need to prefer according to your requirement :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/intro-fw.html

rate if it Helps.

Thanks,

Ankita

[Serpent2010]

Thank you for your reply.

But how about if I have on two different physical interfaces two different inside subnets (e.x.172.x.x.x & 10.x.x.x), would the Transparent mode be bale to handle this scenario?

As I know, in transparent mode all interfaces (insides and outside) shall be on same subnet.  

[ankojha]

Hi,

In that case, you don't need transparent mode and can go for routed mode.

Rate if it helps.

Thanks,

Ankita