Cisco ASA Series User Manual

1-7
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the Transparent or Routed Firewall
Licensing Requirements for the Firewall Mode
The attacker, however, sends another ARP response to the host with the attacker MAC address instead
of the router MAC address. The attacker can now intercept all the host traffic before forwarding it on to
the router.
ARP inspection ensures that an attacker cannot send an ARP response with the attacker MAC address,
so long as the correct MAC address and the associated IP address are in the static ARP table.
MAC Address Table
The ASA learns and builds a MAC address table in a similar way as a normal bridge or switch: when a
device sends a packet through the ASA, the ASA adds the MAC address to its table. The table associates
the MAC address with the source interface so that the ASA knows to send any packets addressed to the
device out the correct interface.
The ASA 5505 includes a built-in switch; the switch MAC address table maintains the MAC
address-to-switch port mapping for traffic within each VLAN. This section only discusses the bridge
MAC address table, which maintains the MAC address-to-VLAN interface mapping for traffic that
passes between VLANs.
Because the ASA is a firewall, if the destination MAC address of a packet is not in the table, the ASA
does not flood the original packet on all interfaces as a normal bridge does. Instead, it generates the
following packets for directly connected devices or for remote devices:
• Packets for directly connected devices—The ASA generates an ARP request for the destination IP
address, so that the ASA can learn which interface receives the ARP response.
• Packets for remote devices—The ASA generates a ping to the destination IP address so that the ASA
can learn which interface receives the ping reply.
The original packet is dropped.
Licensing Requirements for the Firewall Mode
The following table shows the licensing requirements for this feature.
Default Settings
The default mode is routed mode.
Transparent Mode Defaults
• By default, all ARP packets are allowed through the ASA.
• If you enable ARP inspection, the default setting is to flood non-matching packets.
• The default timeout value for dynamic MAC address table entries is 5 minutes.
• By default, each interface automatically learns the MAC addresses of entering traffic, and the ASA
adds corresponding entries to the MAC address table.
Model License Requirement
All models Base License.

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English