Transparent Mode

[amar_5664]

Rather unconventional design that i am trying to test with transparent mode firewall.... attached diagram

Clients [VLAN 100] connected on L3 Switch with SVI as default gateway

Firewall using one physical port which is sub-interfaced with INSIDE-100 and OUTSIDE-200 interfaces

What's working

- ICMP when initiated from L3 Switch SVI to Client VLAN 100 works fine as i can see traffic through firewall

What's not working

- Packet inspection when ICMP initiated from Client 10.x.100.10 to Client 10.x.100.20 does not go through firewall 

As L3 Switch is holding arp and mac, client to client will work. This is where i would like transparent firewall to be the bump and have all client to client traffic go through the firewall. Note the default gateway for the clients is on the L3 switch which cannot be changed. 

Will appreciate your comments. I will rather not want to go the routed mode path and test to see if any solution with transparent mode works.

[Pranay Prasoon]

there is no way ASA can bump in. You will rather need to direct your arp broadcast to ASA.

if switch connected to ASA has a layer 2 t then switch will forward broadcast out of all vlan it received it  on. example when 192.168.100.10 for 192.168.100.20, ASA will see one side of broadcast. However when 192.168.100.20 will broadcast arp it will again be heard on sub-interface with vlan 100 on ASA (switch will not forward arp on vlan 200, since all machines are on vlan 100).

[Jon Marshall]

Pranay

switch will not forward arp on vlan 200, since all machines are on vlan 100

just to clarify, if the diagram is wrong and the 10.x.100.20 client is in vlan 200 then it should work shouldn't it ? 

Jon

[Pranay Prasoon]

no it won't work. That's what I told him. ASA sub-interface with vlan 100 will see the arp but not sub-interface with vlan 200. 

[Jon Marshall]

Okay then how does a transparent firewall setup work then.

I thought it was exactly that ie two vlans using the same IP subnet and the firewall joined the vlans together.

Jon

[Pranay Prasoon]

first of all they is no u-trun on transparent firewall.. In this case ASA will see both MAC address behind same interface.

It is not clear from diagram if there are two switch or 1 switch. because he is talking about sub-interface.

However assuming two switches Assuming, three scenario is possible

a) there is only vlan 100 on two switches

switch1--------------------------ASA--------------------switch2

and ASA is connected to both switch via vlan 100 on two separate physical interface . Then it will work

b) there are two vlan 100 and vlan 200 on two swithes

switch1(vlan 100)----------------------ASA---------switch2 (vlan 200)

ASA connected to two switches on access vlan 100 and 200. And machines on vlan 100 and 200 are in same network. It will work.

c)    switch 1(vlan 100)---------------ASA------switch 2 (vlan 200)

if ASA is connected to switches on their L3 interface and being connected through switch 1 on sub-interface 100 and switch 2 on sub-interface 200. It will work.

[Jon Marshall]

Pranay

first of all they is no u-trun on transparent firewall.. In this case ASA will see both MAC address behind same interface.

Ahh, so are you saying you cannot use subinterfaces with transparent mode ie. you can only use physical interfaces ?

Jon

[Pranay Prasoon]

yes. You can only use it when two vlan have two different network.

[Jon Marshall]

Makes sense now because obviously you aren't configuring any IPs on those interfaces so I understand what you mean by the ASA sees both mac addresses behind the same interface.

Just never occurred to me before.

Many thanks for clarifying.

Jon

[Pranay Prasoon]

Transparent FW is just like a partial switch and assumes host in same vlan behind same interface should communicate without its  interference.

In switch it avoid loops.

Hope that helps

[amar_5664]

thanks for your responses guys, what i gather is the only way to make it work is to have physically separate switches then use ASA to bridge traffic

ASA is connected on same switch 

VLAN 100 is where clients are whereas VLan200 will be SVI just for IP routing. As with ASA transparent mode IN and OUT requires separate VLANs for same network hence sub-intfd port to VLAN 100 for IN traffic and sub-intfd VLAN 200 for OUT traffic to IP route.

What is puzzling me is when i initiate ICMP from the Switch SVI which is int vlan 200 [10.x.100.1] to Client connected on same switch 10.x.100.10 the traffic is going through Firewall IN and OUT interfaces. As i have not allowed the traffic i can see deny hits on the firewall. Whereas when an ICMP is initiated from Client 10.x.100.10 to client 10.x.100.20 it does not go through firewall which i assume is using L3 switches Arp and forwarding packets through but shouldnt it have same behaviour when Switch initiates ICMP to CLient??

I hope its not confusing 

[Jon Marshall]

Pranay may well know better but you don't need two switches as far as I know.

The issue seems to be you can't use subinterfaces.

So if you used two physical interfaces on the ASA you can use the same switch but you can't have SVIs for both vlans ie. you choose one of the vlans and have an SVI for that but not the other.

But you don't put all your clients into one of the vlans otherwise why use the firewall in transparent mode.

I was assuming you wanted to firewall between clients in the same IP subnet but it doesn't sound like that is the case ?

Jon

[Pranay Prasoon · Accepted solution]

interesting...so you have kept 10.x.100.1 in svi 200. Now this is good for learning but a bad network design.

Now here is the deal.

scenario 1:-

When SVI pings any host in 10.x.10.0/24, it assumes all client machine connected in vlan 200. So it will forward mac arp in vlan 200. Once ASA receives it  with vlan tag 200. It switches arp mac header and sends it tagging with vlan 100. So when switch gets it in vlan 100 it forwards it back to all interface in vlan 100.Similar flow works from switch to SVI and ping is successful through ASA.

Scenario 2:-

Now when you ping from Client 10.x.100.10 to Client 10.x.100.20. switch receives it in vlan 100 and forward it to all interface vlan 100 along with vlan 100 tag to ASA. ASA now switches tag of ARP  from 100 to 200 and sends it to switch. Now switch receives it in vlan 200 and ARP dies. So ASA learns mac of only one end.

Other host will still get get arp broadcast because of same vlan on switch. Now when the other host arp, it reaches to client directly and both ARP goes on ASA but on same sub-interface 100.

Rest you can gather from my discussion with John.

[amar_5664]

Thanks guys for your input much appreciated. This is purely for testing couple of scenarios when you have collapsed architecture etc...

i

[Jon Marshall]

Pranay

Now I am really confused :-)

You first scenario in the above suggests the firewall can use subinterfaces in transparent mode to pass traffic ie. the ASA simply switches vlan tags and the ping works.

But you told me it couldn't in our earlier discussion ?

Jon