ASA transparent firewall, hmm untuk apa?

Akan menarik jika sebenarnya Firewall2 tersebut bertindak sebagai layer 2 saja, tapi
dengan catatan :
1.Anda tidak membutuhkan NAT?
nb: hal ini karena memang fungsi layer 2 itu sendiri tidak memungkinkan, ya iyalah ngapain urusan dengan NAT toh sudah di fungsikan sebagai Transparent Firewall.

2.Tidak mau pusing dengan routing, dan kebetulan anda tidak membutuhkannya.
nb: semua fungsi routing nonactive, kecuali management.

lebih lengkapnya :

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008089f467.shtml#mac

simulasi yg gw coba :



asa1# sh run
: Saved
:
ASA Version 8.0(2)
!
firewall transparent
hostname asa1
enable password udw5d/zacCq0PnT1 encrypted
names
!
interface Ethernet0/0
shutdown
nameif inside
security-level 100
!
interface Ethernet0/1
shutdown
nameif outside
security-level 0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
!
interface Ethernet0/3
shutdown
no nameif
no security-level
!
interface Ethernet0/4
shutdown
no nameif
no security-level
!
interface Ethernet0/5
shutdown
no nameif
no security-level
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
pager lines 24
mtu inside 1500
mtu outside 1500
no ip address
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp inside 10.10.10.1 c000.04b8.0000
arp outside 10.10.10.2 c001.04b8.0000
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
!
mac-address-table aging-time 10
mac-address-table static outside c001.04b8.0000
mac-address-table static inside c000.04b8.0000
mac-learn inside disable
arp-inspection outside enable no-flood
username admin password AUIjMufeiBQiWGxp encrypted
prompt hostname context
Cryptochecksum:00000000000000000000000000000000
: end
asa1#

ping ke R2 sukses :


R1#ping 10.10.10.2

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms


yg jadi acuan:
semua mac harus di learn terlebih dahulu dengan static oleh si ASA, kalau gak jangan harap lewat.

bagaimana dengan inspectionnya? semua packet ip layer 3 akan di periksa dengan cara :

The transparent firewall, however, can allow almost any traffic through using either an extended access list (for IP traffic) or an EtherType access list (for non-IP traffic).
LHO koq ada access-list ip traffic? koq bisa kan layer 2, yeee kan dah dibilang
ada static mac..hehe
hehe.ok ya c u...