3

In what situations will an ASA perform route lookup? (transparent mode)

2
  • I don't think it does that except for management traffic if you can call this so. How did you come on this?
    – laf
    Jul 25 '13 at 11:56
  • It does. I have found the question on exam.
    – hell yeah
    Jul 25 '13 at 15:06
12

Primary answer

The ASA will perform MAC Address lookup when in transparent mode.

It will do Route lookup only for the following reasons;

  1. Traffic that originate from the ASA (Syslog for example).
  2. Traffic that is one hop away from the ASA with NAT enabled.
  3. VoIP and DNS traffic with inspection enabled and endpoint is one hop away from the ASA.

Source: Cisco's own doc


Second situation in detail

Again, source: Cisco's own doc

enter image description here

In a nutshell, when the host 192.168.1.2 goes out to reach www.example.com, it will be NATed behind 209.165.201.15.

When the packets come back, the destination is...of course...209.165.201.15. The transparent firewall will "De-Nat" the packet with destination 192.168.1.2.

Since it does not have a MAC address for that specific host (because of the router between the host and the firewall) it will look in it's routing table and send the packets to 10.1.1.3.

2
  • Can you explain 2) in detail?
    – hell yeah
    Jul 25 '13 at 17:07
  • What if traffic is one hop away from ASA without NAT enabled.
    – hell yeah
    Jul 26 '13 at 5:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.