Nineth Large Network advanced log and firewall transparent mode

Transparent Mode

features :

1. in routing mode,the ASA acts as a three-tier device that forwards packets based on the destination IP address.

2. in transparent mode,the ASA acts as a two-tier device, based on the purpose of MAC Address forwarding data frame ( when NAT is not configured )

3 ,   In the asa8.0nat; 8.0 and subsequent versions support nat nat asa forwarding packets still use routing lookups.

4. The ASA is different from the switch when it acts as a two-tier device.

Difference:

1.for unicast data frames where the destination MAC address is unknown,theASA will not flood but be discarded directly.

2,ASA does not participate in STP.

3. Allow IPv4 traffic automatically from high-level interfaces to low-level interfaces without the need to configure ACLs

4.allow ARP traffic to traverse in both directions without having to configure ACLs.

the purpose of allowing traversal MAC Address

1. Broadcast MAC address FFFF.FFFF.FFFF

2 ,   ipv4mac address 0100.5e00.0000 0100.5efe. FFFF

3. IPV6 multicast MAC address 3333.0000.0000---3333.ffff.ffff

4. BPDU multicast MAC address 0100.0CCC. CCCD (CISCO private )

5. APPletalk multicast MAC address 0900.0700.0000 - 0900.07ff.ffff

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M00/8C/03/wKioL1hfNAvz4JWhAAA66hgG89k274.jpg-wh_500x0-wm_3 -wmp_4-s_3917366929.jpg "title=" image 1.jpg "alt=" Wkiol1hfnavz4jwhaaa66hgg89k274.jpg-wh_50 "/>

Experimental requirements:

1. Configure the interface address.

2. Configure the VLAN.

3. Configuring One-arm routing

4. Configure transparent mode

5. implement data from R1 through the pix firewall to R3 .

First, Configure the PIX firewall.

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M01/8C/07/wKiom1hfNBaAcEx-AAEanjZARqw536.jpg-wh_500x0-wm_3 -wmp_4-s_2785439308.jpg "title=" image 2.jpg "alt=" Wkiom1hfnbaacex-aaeanjzarqw536.jpg-wh_50 "/>

Second, Switch Settings

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M01/8C/03/wKioL1hfNCKyejV3AABpni-xy-Q717.jpg-wh_ 500x0-wm_3-wmp_4-s_2302521734.jpg "title=" image 3.jpg "alt=" Wkiol1hfnckyejv3aabpni-xy-q717.jpg-wh_50 "/>650) this.width=650; "Src=" http://s1.51cto.com/wyfs02/M02/8C/07/wKiom1hfNCqzBWj3AACS7qHfFaE723.jpg-wh_500x0-wm_3-wmp _4-s_3629438505.jpg "title=" Picture 4.jpg "alt=" wkiom1hfncqzbwj3aacs7qhffae723.jpg-wh_50 "/>650" this.width=650; "src= "Http://s4.51cto.com/wyfs02/M00/8C/03/wKioL1hfNDSSg0zPAACtV3y9LoM053.jpg-wh_500x0-wm_3-wmp_4-s_33676732.jpg" title= "Picture 5.jpg" alt= "wkiol1hfndssg0zpaactv3y9lom053.jpg-wh_50"/>650) this.width=650; "Src=" http://s3.51cto.com /wyfs02/m02/8c/03/wkiol1hfnd-dztucaabxorotpk0506.jpg-wh_500x0-wm_3-wmp_4-s_2036926842.jpg "title=" image 6.jpg "alt=" Wkiol1hfnd-dztucaabxorotpk0506.jpg-wh_50 "/> 

Third, Create a single-arm route

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M00/8C/07/wKiom1hfNEqwOcv_AABcGVXwe28730.jpg-wh_500x0-wm_3 -wmp_4-s_47396114.jpg "title=" image 7.jpg "alt=" wkiom1hfneqwocv_aabcgvxwe28730.jpg-wh_50 "/>650) this.width=650;" Src= "http://s4.51cto.com/wyfs02/M01/8C/07/wKiom1hfNFOSOKpUAADkWiWtE2k456.jpg-wh_500x0-wm_3-wmp_4-s_4097257342. JPG "title=" image 8.jpg "alt=" wkiom1hfnfosokpuaadkwiwte2k456.jpg-wh_50 "/>650" this.width=650; "src="/HTTP/ S3.51cto.com/wyfs02/m00/8c/03/wkiol1hfnf2byfkwaabhax9ntik985.jpg-wh_500x0-wm_3-wmp_4-s_2117630126.jpg "Title=" Picture 9.jpg "alt=" wkiol1hfnf2byfkwaabhax9ntik985.jpg-wh_50 "/>

Four, Manage IP addresses

I p Address subnet mask

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M01/8C/07/wKiom1hfNGax6eaaAABRizCo-TE901.jpg-wh_500x0-wm_3 -wmp_4-s_1524931071.jpg "title=" image 10.jpg "alt=" Wkiom1hfngax6eaaaabrizco-te901.jpg-wh_50 "/>

Five, Validation

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M01/8C/03/wKioL1hfNHHi5IhKAACpmLuznoA458.jpg-wh_500x0-wm_3 -wmp_4-s_1575369713.jpg "title=" image 11.jpg "alt=" Wkiol1hfnhhi5ihkaacpmluznoa458.jpg-wh_50 "/>

Six, View Firewall

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M02/8C/07/wKiom1hfNH7CQuL0AABobixvXog547.jpg-wh_500x0-wm_3 -wmp_4-s_2928832643.jpg "title=" image 12.jpg "alt=" Wkiom1hfnh7cqul0aabobixvxog547.jpg-wh_50 "/>

Seven, set mac address expiration Time

M ac-address-table aging-time minutes

Eight, setting up a static mac entry

M ac-address-table static Inside/outside mac address

Nine, Disable Mac address learning for interfaces

M Ac-learn inside/outside Disable

10. Configuring the Log service

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M02/8C/03/wKioL1hfNI-ydNBOAACnsFnReg0850.jpg-wh_500x0-wm_3 -wmp_4-s_2627595150.jpg "title=" image 13.jpg "alt=" Wkiol1hfni-ydnboaacnsfnreg0850.jpg-wh_50 "/>

Nineth Large Network advanced log and firewall transparent mode