Using Clustered ASAs in Transparent mode to support VRF based Network ?

Hi Guys,
I'm investigating the ways that I can use 2 x ASA (5525x) to accommodate Multi-tenancy situation with overlapping addresses. Unfortunately in this particular scenario we have to stick with 5525x firewalls.
The ASAs are going to be placed in north-south traffic path between 2 routers and these routers need to be configured with multiple VRFs to segregate the traffic for each tenant with overlapping IP subnets ( We are not looking at NAT as a workaround for the time being).
As we know, this ASA model won't support VRFs so we can't use the ASA as a intermediary routing hop and therefore this is not an option.. and using security contexts per VRF seems not scale-able enough (correct me if I'm wrong). So my thinking is that, if we put the ASAs in to the transparent mode and just use the ASAs as a layer 2 interconnect (configured with different VLANs connecting VRFs served by top and bottom routers)  I should be able to go up to maximum of 50 VRFs (since 5525x only supports 200 VLANs).  
I'm also planning to use the 2 ASAs in a cluster mode to aggregate the bandwidth of both ASAs for better throughput.
So I need to clarify following with you guys.. 
1) Can I actually do this or am I missing something.
2) Are there any limitations that I might run in to with this setup
3) Is there anyone out there who's doing the same thing or can you think of a better way to tackle this scenario (with same hardware and requirements)
4) Instead of using clustering, can I use simple Active/Stanby pare and still configure transparent mode and use it that way ?
Appreciate your input.
Thanks
Shamal 

Is any expert out there who can answer my query ?. Much appreciated.

Similar Messages

  • Trying to figure out whether I can use an ASA cluster in Transparent mode to facilitate VRF based network ??

    Hi Guys,
    I had to re-post this here because I did not get any comments earlier.. hopefully I'll get something here.. :)
    I'm investigating the ways that I can use 2 x ASA (5525x) to accommodate Multi-tenancy situation with overlapping addresses. Unfortunately in this particular scenario we have to stick with 5525x firewalls.
    The ASAs are going to be placed in north-south traffic path between 2 routers and these routers need to be configured with multiple VRFs to segregate the traffic for each tenant with overlapping IP subnets ( We are not looking at NAT as a workaround for the time being).
    As we know, this ASA model won't support VRFs so we can't use the ASA as a intermediary routing hop and therefore this is not an option.. and using security contexts per VRF seems not scale-able enough (correct me if I'm wrong). So my thinking is that, if we put the ASAs in to the transparent mode and just use the ASAs as a layer 2 interconnect (configured with different VLANs connecting VRFs served by top and bottom routers)  I should be able to go up to maximum of 50 VRFs (since 5525x only supports 200 VLANs).  
    I'm also planning to use the 2 ASAs in a cluster mode to aggregate the bandwidth of both ASAs for better throughput.
    So I need to clarify following with you guys.. 
    1) Can I actually do this or am I missing something.
    2) Are there any limitations that I might run in to with this setup
    3) Is there anyone out there who's doing the same thing or can you think of a better way to tackle this scenario (with same hardware and requirements)
    4) Instead of using clustering, can I use simple Active/Stanby pare and still configure transparent mode and use it that way ?
    Appreciate your input.
    Thanks
    Shamal 

    There is a limitation on how many context you can have, which depends on the license you have.  This is quite possible with ASA multi routed mode and even with multi transparent mode.  You can have overlapping ip in each context without the need of using nat as long as you have unique mac address for each sub interface.
    Thanks

  • ASA Routed/Transparent Mode - Advice

    Hi guys,
    I'm looking for some advice regarding the deployment of an ASA. I have two networks separated by a routed link (layer 3 switch to layer 3 switch). I would like to deploy an ASA between the two networks for increased security. I'm leaning toward transparent mode so I don't have to have an additional IP subnetwork configured, and because deployment seems a little 'easier'.
    I would welcome any feedback.
    Thanks.

    Hi,
    So there is 2 networks which are separated by a routed link between the L3 switches? Have you considered simply moving the LAN and Link networks IP address to a Routed Mode ASAs interfaces when inserting it between these networks or is there something on the L3 switch that prevents this?
    Naturally you can use the ASA in Transparent Mode also. I have not deployed Transparent ASAs as usually the Routed Mode has been required. Even firewalls installed to internal networks (like between factory automation and office networks) have always been in Routed mode.
    Looking at the ASA Configuration Guide the limitations set by the Transparent Mode are not something that would prevent us from using them instead of the current setups. I would imagine that the most important limitation in many setups has usually been the fact that the VPN is not supported in Transparent mode though I guess in your case that would not be a problem.
    The ASA Configuration Guide section on Transparent mode (guidelines/limitations) can be found here:
    http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/intro-fw.html#pgfId-1501525
    - Jouni

  • ASA in transparent mode and IP addresses

    Hello,
    I need to put an ASA in transparent mode.
    Our router (managed by the carrier) routes more than one public IP class in a single VLAN.
    On the "Cisco Security Appliance Command Line Configuration guide", in "Trasnaprent Firewall Guidelines" it's written: "Each directly connected network must be on the same network".
    This means also that I can have ONLY ONE subnet that flows fron the outside and the inside, or can I have more than one class?
    If I can have only one class, the only solution is to use multiple context (and separate each classes in different interfaces)?
    Thanks a lot

    The ASA in trasparent mode works at layer 2. So it really does not care if the traffic that flows through it is from different subnet as long as the L3 devices it connects to knows how to reach these subnet. TheASA in transparent is basically a bump in the wire (a bridge) and for that reason you can only use 2 interfaces on the ASA in transparent implementation.
    P.S. When people see attitude in your threads, they will refrain from answering your question. That's for future reference.

  • Cisco ASA 55XX Transparent mode VLAN traversing

    Hello Cisco Forum Team!
        In a scenario where the Cisco ASA is in Transparent mode, is it possible to transmit L2 traffic from other VLANs different than the native VLAN the management IP of the firewall resides?
    The switches on the outside and inside interfaces of the ASA are in trunk mode and I am trying to pass L2 VLAN ttraffic from inside to outside and vice-versa using filters on the switches (switchport trunk allowed vlan). 
    Thanks in advanced for your support and comments!

    Yes it is possible but you will be limited to 8 VLANs, or more accurately, 8 BVI interfaces so this is not a scalable solution.  The catch is that you will need to have different VLANs for the same subnet at either end of the ASA. 
    To clarify this, lets say you are using interface Gig0/1 and Gig0/2.  On Gig0/1 you would have configured subinterfaces with VLANs 2, 3, and 4.  Now if you try to configure these same VLANs on Gig0/2 you will get an error saying something like this VLAN is already configured on another interface...I don't remember the exact error. 
    So to get this working you would need to configure Gig0/2 with subinterfaces for VLANs...lets say...5, 6, and 7.  you would then associate VLANs 2 and 5 with BVI 1, VLANs 3 and 6 with BVI 2, and VLANs 4 and 7 with BVI 3.  Each BVI interface would have its own IP address for the subnet that is being bridged across the ASA.
    Please remember to select a correct answer and rate helpful posts

  • Cisco ASA 5512 Transparent mode

                       Hi all - hope this is the right place to ask this question-
    I'm having trouble understanding how to configure an ASA 5512X in what should be a really easy way -
    I simply want the ASA to be a transparent Layer 2 "bump" in a routed link between two networks, and then I'll use the Management interface to actually see the firewall ASDM,Syslog, configure, etc.
    I have the interfaces set up thusly:
    interface GigabitEthernet0/0
    nameif UnTrustedNetwork
    security-level 0
    interface GigabitEthernet0/1
    nameif TrustedNetwork
    security-level 100
    interface Management0/0
    nameif ManagementAccess
    security-level 100
    ip address 192.168.X.Y 255.255.255.0
    management-only
    I cannot figure out how to install a default route so that interface Management0/0 with it's IP of 192.168.X.Y can be reached from
    other networks, like 10.6.X.Y, etc.
    I thought the point of a Management interface was that you could set things up in such a way that the Management interface
    was the only way you could access the firewall, and you did not have to have IP addresses on the Gig interfaces,
    (at least not in transparent mode, for NAT you obviously would have to)
    I tried to add a static route entry to 10.6.X.Y , but
    when I typed "route.." my only available destination interfaces were either TrustedNetwork or UnTrustedNetwork ??
    How do I configure the Management interface for non-local subnets to be reachable on the firewall in transparent mode?

    transparent firewall is configured differently from routed mode.
    here's a basic config required:
    firewall transparent               (erases the current config; does not require a reboot)
    interface BVI1
    ip address 192.168.10.10 255.255.255.0
    interface GigabitEthernet0
    nameif outside
    bridge-group 1
    security-level 0
    interface GigabitEthernet1
    nameif inside
    bridge-group 1
    security-level 100
    route outside 0.0.0.0 0.0.0.0 192.168.10.254
    route inside 10.0.0.0 255.0.0.0 192.168.10.100
    I think that you need a BVI interface with an IP address before the ASA starts forwarding traffic
    The old syntax (pre 8.3 or 8.2 not sure) forces only 2 interfaces and no BVI was configured... the IP was assigned in global config.
    Hope that helps,
    Patrick

  • Cisco WSA : Is it possible to use web proxy in transparent mode without WCCP router ?

    Hello !
    I would like to use Cisco WSA as a web proxy in a transparent way (without any configuration in client's web browsers) but i don't have a WCCP router. So, is it possible ? 
    If yes, how to do this ? 
    Thank you,
    Stephane Walker

    Hi Stephane
    The only alternative to WCCP is PBR (Policy Based Routing). With a simple configuration on the router you can redirect traffic defined as interesting by access list to WSA. On the WSA you need to configure transparent mode (Security Services -> Web Proxy -> Edit Settings -> Proxy Mode: Transparent). You also need to assure that proxy is listening on the port 80 and that HTTPS proxy is enabled (on port 443) if you want to redirect the HTTPS traffic as well. 
    Sample configuration for Cisco router
    access-list 110 permit tcp any any eq www
    route-map proxy-redirect permit 10
    match ip address 110
    set ip next-hop xxx.xxx.xxx.xxx
    interface ethernet0/1
    ip policy route-map proxy-redirect
    xxx.xxx.xxx.xxx is the proxy IP in such case and access-list 110 defines web traffic (HTTP TCP/80) as interesting.
    The biggest disadvantage of such solution is lack of failure detection. If the proxy will go down for some reason router will keep redirecting the traffic causing internet access outage.
    Routers other than Cisco equipment should also have an option to configure policy based routing.
    /Artur
    Ps. It's not possible to place the WSA in-line between clients and the internet.

  • ASA 5510 in Transparent Mode-Guidelines.

    Dear all,
    I need to convert routed mode to transparent mode on my ASA-5510 with inbuilt IPS.
    let me know which of the following features configured on my firewall will have issue if converted to transparent mode:
    1. static routes.
    2. object-groups.
    3. ACLS.
    4. URL-filter (Websense).
    5. IPS . ( i doubt this )
    6. have 3 data and 1 Mgmt interfaces.
    7. syslog.
    8. SNMP
    I'm sure point 5 and 6 will have issues, need to confirm.
    need to confirm this by EOD,
    ( 5 hours more).
    thanks in advance.
    Shukla.

    Does not participate in routing protocols but can still pass routing protocol traffic through it. You can define static routes for the traffic originated by the ASA.
    in transparante mode the devices dehind and infront of the firewall will be in the same ip subnet as the firewall will be a L2 device!!
    ACLs can be configured normally
    syslog as well
    obgect groups as well
    Address translation is inherent when a firewall is configured for routed mode. Beginning with
    ASA 8.0, address translation can be used in transparent mode as well
    Does not participate in multicast. However, it allows passing the multicast traffic through it using the ACLs.
    Does not support QoS.
    Inspects Layer 2 and higher packet headers
    as long as u can use
    policy-map global_policy
    then u can integrate with IPS if u mean AIP-ssm modul
    transparent also known as a Layer 2 firewall or a stealth firewall, because its
    interfaces have no IP addresses and cannot be detected or manipulated. Only a single
    management address can be configured on the firewall
    In transparent mode, a firewall can support only two interfaces-the inside and the outside. If
    your firewall supports more than two interfaces from a physical and licensing standpoint, you
    can assign the inside and outside to two interfaces arbitrarily. As soon as those interfaces are
    configured, the firewall does not permit a third interface to be configured.
    Some platforms also support a dedicated management interface, which can be used for all
    firewall management traffic. However, the management interface cannot be involved in
    accepting or inspecting user traffic
    Configure a management address:
    Firewall(config)# ip address ip_address subnet_mask
    The firewall can support only a single IP address for management purposes. The address is
    not bound to an interface, as in routed mode. Rather, it is assigned to the firewall itself,
    accessible from either of the bridged interfaces.
    The management address is used for all types of firewall management traffic, such as Telnet,
    SSH, HTTP, SNMP, Syslog, TFTP, FTP, and so on.
    A transparent firewall can also support multiple security contexts. In that case, interface IP
    addresses must be configured from the respective context. The system execution space uses
    the admin context interfaces and IP addresses for its management traffic
    You do not have to configure a static route for the subnet directly connected to the firewall
    interfaces. However, you should define one static route as a default route toward the outside
    public network
    i wish i covered all ur questions
    good luck
    if helpful Rate

  • ASA Transparent mode multicast traffic in 8.2 and 8.4

    Hi,
    When i configure 8.2 in trasparent mode and deploy the a network that was wrok on EIGRP after that i found the neighborship was stop when i allow the mutlicast address and prtocol on outside interface it was start the working But when i deploy an ASA with 8.4 IOS and then allow the multicast address and protocol both the interface (Inside and outside) after that it was start working.
    So i want to know that what the reasion to allow multicast address and protocol on 8.4 IOS for both interface. I am not able to find any answer for this.

    Hi Mahesh,
    By default ASA in transparent mode do not allow any packets not having a valid EtherType greater than or equal to 0x600. As per my knowledge this concept remain same for all versions of ASA. Most control plane protocols are denied.
    ASA in transparent mode only allows ARP, broadcast traffic, TCP and UDP inspected unicast traffic.
    For EIGRP to work through transparent firewall, we need to open ACLs in both direction for multicast and unicast both type of EIGRP traffic on all versions of ASA Firewall.

  • ASA Transparent Mode & Routing

    Since ASA in transparent mode acts like a cable, do I need to have the routes on the firewall except for the management?

    You need to put routes only for the traffic originating from the firewall.

  • VRF issue with Firewall in transparent Mode.

    Hi Guys,
    I have 7609 Router and 6513 L3 Switch connected Through ASA 5545.
    I am running Multiple VRF between router and Switch and BGP routing Protocol. When they are connected directly to each other everything is normal, however, when I have connected them via ASA 5545 then everything fails. I am using ASA in transparent Mode.
    My question is: Do ASA require different setting in case of VRF? If yes, then please give me sample config.

    I have taken following output from Firewall will this be any help?
    sh interface ouTSIDE
    Interface GigabitEthernet0/1 "OUTSIDE", is up, line protocol is up
      Hardware is i82574L rev00, BW 1000 Mbps, DLY 10 usec
            Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
            Input flow control is unsupported, output flow control is off
            MAC address 7c69.f68f.df78, MTU 1500
            IP address 175.4.8.35, subnet mask 255.255.255.248
            8435 packets input, 680680 bytes, 0 no buffer
            Received 8135 broadcasts, 0 runts, 0 giants
            0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
            0 pause input, 0 resume input
            8138 L2 decode drops
            0 packets output, 0 bytes, 0 underruns
            0 pause output, 0 resume output
            0 output errors, 0 collisions, 1 interface resets
            0 late collisions, 0 deferred
            0 input reset drops, 0 output reset drops
            input queue (blocks free curr/low): hardware (476/461)
            output queue (blocks free curr/low): hardware (511/511)
      Traffic Statistics for "OUTSIDE":
            297 packets input, 118503 bytes
            0 packets output, 0 bytes
            297 packets dropped
          1 minute input rate 0 pkts/sec,  13 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  6 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    ciscoasa# show asp drop
    Frame drop:
      FP L2 rule drop (l2_acl)                                                   297
    ASA Version 9.0(1)
    firewall transparent
    ciscoasa# show module all
    Mod Card Type                                    Model              Serial No.
      0 ASA 5545-X with SW, 8 GE Data, 1 GE Mgmt     ASA5545           
    ips ASA 5545-X IPS Security Services Processor   ASA5545-IPS       
    Mod MAC Address Range                 Hw Version   Fw Version   Sw Version
      0 7c69.f68f.df77 to 7c69.f68f.df80  1.0          2.1(9)8      9.0(1)
    ips 7c69.f68f.df75 to 7c69.f68f.df75  N/A          N/A          7.1(4)E4
    Mod SSM Application Name           Status           SSM Application Version
    ips IPS                            Up               7.1(4)E4
    Mod Status             Data Plane Status     Compatibility
      0 Up Sys             Not Applicable
    ips Up                 Up
    Mod License Name   License Status  Time Remaining
    ips IPS Module     Enabled         perpetual
    ciscoasa#
    I have create Ehtertype ACL and permit any traffic.
    cdp traffic has passed through but I am still not able to ping :(

  • Transparent mode with AIP-SSM-20

    I currently have an ASA5510 in routed mode with an AIP-SSM-20.
    There is a requirement to use a fibre optic connection between this ASA and another ASA across campus, so the AIP-SSM will have to be removed and replaced with the SSM-4GE.  This part should present no issue.
    However, this will remove the IPS device, and I still want to use IPS.
    So, what I am thinking is to get another ASA5510, install the AIP-SSM, configure ASA for transparent mode and put it in between the inside of the routed ASA and my LAN.  The transparent ASA would be functioning strictly as an IPS appliance.
    Setup would look something like this:
    Internal LAN <> transparent ASA with IPS <> routed ASA <> WAN
    Can the AIP-SSM still perform IPS with the ASA in transparent mode?
    Is there a way to configure the ASA and AIP-SSM such that traffic to/from a particular server completely bypasses the AIP-SSM?
    I have a couple of fileservers that generate heavy traffic and could overload the AIP-SSM.
    Regards.

    AFAIR, There is no problem to setup AIP in a transparent firewall.
    "An ASA in transparent mode can run an AIP.  In the event the AIP fails,
    the IPS will fail-open and the ASA will continue to pass traffic.
    However, if an interface or cable fails, then traffic will stop.  You
    would need a failover pair to account for this failure event, which
    means another ASA and matching AIP."
    And no there is no problem to exclude certain hosts/ports/subnets from inspection by IPS via MPF.
    http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ips.html#wp1050744
    What I however consider however is if the ASAs 5510 as second tier firewall for 5520s will be enough.
    http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html
    HTH,
    Marcin

  • ASA5505 Transparent mode

    I am trying to use a 5505 in transparent mode. I have always used routed mode previously, so I am sure I am missing something simple. Essentially we are creating a shared network space with another IT entity. We are using a class C address space in total, but splitting it in half between each group. My understanding is that if I want to have a FW on our side, i need to have it in transparent mode since it is all one address space. I am having trouble communicating with the other side. I am essentially ont the 172.16.3.128/25 suide. I am unable to pass traffic/ping the other side, 172.16.3.1. If I take the FW out completely and jsut put a router in it works fine, so I know I am missing something on the ASA configuration, and have tried all kinds of route and acl settings. A basic network layout is attached along with the FW config. Any help would be appreciated.

    If your requirement is to just separate /24 address space into two halves and monitor the traffic between these new subnets then it is possible in router mode itself.
    You can assign one IP from 172.16.5.1-127/25 address space to your inside interface.
    Similarly one IP from 172.16.5.128-255/25 address space to your outside interface.
    And configure users sitting behind inside interface to have default gateway as inside interface's IP. Similarly configure users behind outside interface with default gateway as outside interface's IP.
    When you break the subnet from /24 to /25, the communication between two /25 subnets will be through ASA. So you can configure ACLs to monitor traffic.
    Hope it helps.

  • Asa 5505 transparent firewall issue

    hi i am having uc560 with voice and data vlan and i am having 3560 layer3 switch and my network is working fine the dhcp for voice and data both are running in uc560.
    now i  add asa 5505 between uc560 and switch in transparent mode means from uc560 to asa 5505 outside interface and from asa inside interface to switch,
    i conigured vlan1 -- inside and vlan 2 as outside in asa  5505
    in my uc 560 data is vlan 1 and my voice is vlan 100.
    when i connect my network with transparent mode firewall no dhcp amd no phones are working . but if i remove asa and i connect with uc560 to switch everything is fine.
    is there anyway to work multiple voice and data vlan in asa 5505 transparent mode.

    hi rojas,
    here is my problem,
    my internet and voice all connected in the uc 560 so wat i am doing i am connecting firewall outside to uc 560 trunk port and the from inside to my switch.
    when i connec to my switch it is giving message inconsistant vlan and it is port is blocked. and my phones are not working.
    my data vlan1 is 192.168.123.x
    and my voice vlan100 is  10.1.1.x
    and the firewall ip 192.168.123.3

  • IPS in Transparent Mode

    Hi,
    I need to know if the 5512X IPS will work if the ASA is in transparent mode and/or any limitations.
    Thanks.

    Hello,
    Yes, it can definetly run on transparent mode
    An ASA in transparent mode can run an AIP.  In the event the AIP fails,
    the IPS will fail-open and the ASA will continue to pass traffic.
    However, if an interface or cable fails, then traffic will stop.  You
    would need a failover pair to account for this failure event, which
    means another ASA and matching AIP."
    Regards,
    Julio

Maybe you are looking for