Filter
Top Products
10-3
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter 10 Configuring the Transparent or Routed Firewall
Configuring the Firewall Mode
The ASA does not support traffic on secondary networks; only traffic on the same network as the
management IP address is supported.
Management Interface (ASA 5510 and Higher)
In addition to each bridge group management IP address, you can add a separate Management slot/port
interface that is not part of any bridge group, and that allows only management traffic to the ASA. For
more information, see the “Management Interface” section on page 12-2.
Allowing Layer 3 Traffic
• IPv4 and IPv6 traffic is allowed through the transparent firewall automatically from a higher security
interface to a lower security interface, without an access list.
• ARPs are allowed through the transparent firewall in both directions without an access list. ARP
traffic can be controlled by ARP inspection.
• For Layer 3 traffic travelling from a low to a high security interface, an extended access list is
required on the low security interface. See Chapter 37, “Configuring Access Rules,” for more
information.
Allowed MAC Addresses
The following destination MAC addresses are allowed through the transparent firewall. Any
MAC address not on this list is dropped.
• TRUE broadcast destination MAC address equal to FFFF.FFFF.FFFF
• IPv4 multicast MAC addresses from 0100.5E00.0000 to 0100.5EFE.FFFF
• IPv6 multicast MAC addresses from 3333.0000.0000 to 3333.FFFF.FFFF
• BPDU multicast address equal to 0100.0CCC.CCCD
• AppleTalk multicast MAC addresses from 0900.0700.0000 to 0900.07FF.FFFF
Passing Traffic Not Allowed in Routed Mode
In routed mode, some types of traffic cannot pass through the ASA even if you allow it in an access list.
The transparent firewall, however, can allow almost any traffic through using either an extended access
list (for IP traffic) or an EtherType access list (for non-IP traffic).
Non-IP traffic (for example AppleTalk, IPX, BPDUs, and MPLS) can be configured to go through using
an EtherType access list.
Note The transparent mode ASA does not pass CDP packets, or any packets that do not have a valid EtherType
greater than or equal to 0x600. For example, you cannot pass IS-IS packets. An exception is made for
BPDUs, which are supported.
Passing Traffic For Routed-Mode Features
For features that are not directly supported on the transparent firewall, you can allow traffic to pass
through so that upstream and downstream routers can support the functionality. For example, by using
an extended access list, you can allow DHCP traffic (instead of the unsupported DHCP relay feature) or