CHAPTER
15-1
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
15
Firewall Mode Overview
This chapter describes how the firewall works in each firewall mode. To set the firewall mode, see the
“Setting Transparent or Routed Firewall Mode” section on page 2-5.
This chapter includes the following sections:
• Routed Mode Overview, page 15-1
• Transparent Mode Overview, page 15-7
Routed Mode Overview
In routed mode, the security appliance is considered to be a router hop in the network. It can perform
NAT between connected networks, and can use OSPF or passive RIP (in single context mode). Routed
mode supports many interfaces. Each interface is on a different subnet. You can share interfaces between
contexts.
This section includes the following topics:
• IP Routing Support, page 15-1
• Network Address Translation, page 15-1
• How Data Moves Through the Security Appliance in Routed Firewall Mode, page 15-2
IP Routing Support
The security appliance acts as a router between connected networks, and each interface requires an
IP address on a different subnet. In single context mode, the routed firewall supports OSPF and RIP (in
passive mode). Multiple context mode supports static routes only. We recommend using the advanced
routing capabilities of the upstream and downstream routers instead of relying on the security appliance
for extensive routing needs.
Network Address Translation
NAT substitutes the local address on a packet with a global address that is routable on the destination
network. By default, NAT is not required. If you want to enforce a NAT policy that requires hosts on a
higher security interface (inside) to use NAT when communicating with a lower security interface
(outside), you can enable NAT control (see the nat-control command).
To Next Page
Loading...
Need help?
General