Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 195)

100

101

12-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 12 Firewall Mode Overview

Transparent Mode Overview

Transparent Firewall Features

Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its

screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a “bump

in the wire,” or a “stealth firewall,” and is not seen as a router hop to connected devices. The security

appliance connects the same network on its inside and outside ports. Because the firewall is not a routed

hop, you can easily introduce a transparent firewall into an existing network; IP readdressing is

unnecessary.

Maintenance is facilitated because there are no complicated routing patterns to troubleshoot and no NAT

configuration.

Even though transparent mode acts as a bridge, Layer 3 traffic, such as IP traffic, cannot pass through

the security appliance unless you explicitly permit it with an extended access list. The only traffic

allowed through the transparent firewall without an access list is ARP traffic. ARP traffic can be

controlled by ARP inspection.

In routed mode, some types of traffic cannot pass through the security appliance even if you allow it in

an access list. The transparent firewall, however, can allow any traffic through using either an extended

access list (for IP traffic) or an EtherType access list (for non-IP traffic).

Note The transparent mode security appliance does not pass CDP packets.

For example, you can establish routing protocol adjacencies through a transparent firewall; you can

allow OSPF, RIP, EIGRP, or BGP traffic through based on an extended access list. Likewise, protocols

like HSRP or VRRP can pass through the security appliance.

Non-IP traffic (for example AppleTalk, IPX, BPDUs, and MPLS) can be configured to go through using

an EtherType access list.

For features that are not directly supported on the transparent firewall, you can allow traffic to pass

through so that upstream and downstream routers can support the functionality. For example, by using

an extended access list, you can allow DHCP traffic (instead of the unsupported DHCP relay feature) or

multicast traffic such as that created by IP/TV.

When the security appliance runs in transparent mode, the outgoing interface of a packet is determined

by performing a MAC address lookup instead of a route lookup. Route statements can still be configured,

but they only apply to security appliance-originated traffic. For example, if your syslog server is located

on a remote network, you must use a static route so the security appliance can reach that subnet.

1 2 ... 190 191 192 193 194 195 196 197 198 199 200 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 195

Komentarze do niniejszej Instrukcji