In what situations will an ASA perform route lookup? (transparent mode)
-
I don't think it does that except for management traffic if you can call this so. How did you come on this?– lafJul 25, 2013 at 11:56
-
It does. I have found the question on exam.– hell yeahJul 25, 2013 at 15:06
Add a comment
|
1 Answer
Primary answer
The ASA will perform MAC Address lookup when in transparent mode.
It will do Route lookup only for the following reasons;
- Traffic that originate from the ASA (Syslog for example).
- Traffic that is one hop away from the ASA with NAT enabled.
- VoIP and DNS traffic with inspection enabled and endpoint is one hop away from the ASA.
Source: Cisco's own doc
Second situation in detail
Again, source: Cisco's own doc
In a nutshell, when the host 192.168.1.2 goes out to reach www.example.com, it will be NATed behind 209.165.201.15.
When the packets come back, the destination is...of course...209.165.201.15. The transparent firewall will "De-Nat" the packet with destination 192.168.1.2.
Since it does not have a MAC address for that specific host (because of the router between the host and the firewall) it will look in it's routing table and send the packets to 10.1.1.3.
