Overview and basic configuration for the Cisco ASA running in transparent mode.
Overview
Traditionally, a firewall is a routed hop and acts as a default gateway for hosts connected to the protected networks. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a “bump in the wire,” or a “stealth firewall,” and is not seen as a routed hop to connected devices. However, security policy, NAT, and most other security functions are the same as any other firewall.
Layer 2 connectivity is achieved by using a “bridge group” where you group together the inside and outside interfaces for a network, which allows traffic to pass between the “bridged” interfaces. Since the firewall is a “bump in the wire”, another router is required to function as the Layer 3 router for client or point-to-point networks.
Transparent firewalls are commonly sandwiched between two routers. The configuration and examples in this lab follow the topology diagram below:
Details
A production ready ASA configuration can be quite complex. The following guide touches on the basic steps required to enable a Cisco ASA as a transparent firewall based on the network diagram above.
First enable transparent mode:
firewall transparent
Transparent firewalls enforce network policy between devices by connecting two interfaces together through a layer 2 bridge. Start by creating a bridge virtual interface with an IP address that exists within the Layer 3 interfaces bridged together. The fusion-outside router interface is 192.168.0.50 and fusion-inside is 192.168.0.49, the next available IP address is assigned to the BVI:
interface BVI1
ip address 192.168.0.51 255.255.255.240
The BVI interface connects physical interfaces to create the layer 2 path through the ASA. Add the BVI to each physical interface. In addition, set the nameif to a descriptive name, these names will be used later in the configuration. Finally, set the security-level. Traffic moving from a larger to a smaller number is automatically allowed. Traffic moving from a smaller to larger number requires an access policy in order to communicate:
interface GigabitEthernet0/0
bridge-group 1
nameif inside
security-level 90
interface GigabitEthernet0/1
bridge-group 1
nameif outside
security-level 10
As noted above, communication from a smaller security-level to a larger one is blocked by default. To allow packets from the outside to the inside interface, a security policy must be created. In this example, we allow icmp as a way to test communication:
access-list acl_outside extended permit icmp any any
access-group acl_outside in interface outside
Enable logging to diagnose connection or policy issues:
logging enable
logging buffered debugging
logging timestamp
The full configuration for a transparent Cisco ASA:
firewall transparent
interface GigabitEthernet0/0
bridge-group 1
nameif inside
security-level 90
interface GigabitEthernet0/1
bridge-group 1
nameif outside
security-level 10
interface BVI1
ip address 192.168.0.51 255.255.255.240
access-list acl_outside extended permit icmp any any
access-group acl_outside in interface outside
logging enable
logging buffered debugging
logging timestamp
From the fusion router validate ICMP is allowed through:
fusion-outside#ping 192.168.0.49
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.49, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/4 ms
Validate the ASA is logging connections:
Mar 03 2021 03:36:33: %ASA-7-609001: Built local-host outside:192.168.0.50
Mar 03 2021 03:36:33: %ASA-7-609001: Built local-host inside:192.168.0.49
Mar 03 2021 03:36:33: %ASA-6-302020: Built inbound ICMP connection for faddr 192.168.0.50/12 gaddr 192.168.0.49/0 laddr 192.168.0.49/0 type 8 code 0
Mar 03 2021 03:36:33: %ASA-6-302020: Built outbound ICMP connection for faddr 192.168.0.50/12 gaddr 192.168.0.49/0 laddr 192.168.0.49/0 type 0 code 0
Mar 03 2021 03:36:35: %ASA-6-302021: Teardown ICMP connection for faddr 192.168.0.50/12 gaddr 192.168.0.49/0 laddr 192.168.0.49/0 type 8 code 0
Mar 03 2021 03:36:35: %ASA-6-302021: Teardown ICMP connection for faddr 192.168.0.50/12 gaddr 192.168.0.49/0 laddr 192.168.0.49/0 type 0 code 0
Mar 03 2021 03:36:35: %ASA-7-609002: Teardown local-host inside:192.168.0.49 duration 0:00:02
Mar 03 2021 03:36:35: %ASA-7-609002: Teardown local-host outside:192.168.0.50 duration 0:00:02
Validate the firewall is denying traffic by telnetting from the outside router to the inside router:
fusion-outside#telnet 192.168.0.49
Trying 192.168.0.49 ...
% Connection timed out; remote host not responding
ASA is denying and logging packets not explicitly allowed from the outside to inside interface:
Mar 03 2021 03:42:02: %ASA-4-106023: Deny tcp src outside:192.168.0.50/21979 dst inside:192.168.0.49/23 by access-group "acl_outside" [0x0, 0x0]