zone-based firewall acts like a Layer 3 node in a network, and inspects the IP
traffic that passes through the node. The traditional firewall is a routed hop
and acts as a default gateway for hosts that connect to one of its screened
subnets. However, to place this Layer 3 firewall in an existing network
requires the network to be re-subnetted, which is time and resource-intensive.
The Layer 2 transparent firewall is transparent to the network and does not
require Layer 3 separation between segments. A transparent firewall acts like a
“bump in the wire” or a “stealth firewall,” and is not seen as a router hop to
connected devices. Because the firewall is not a routed hop, you can easily
introduce a transparent firewall into an existing network; IP readdressing is
unnecessary. The transparent firewall operates on bridged packets and the Layer
3 firewall operates on routed packets.
firewall is enabled on a pair of locally-switched Ethernet ports. Embedded IP
packets forwarded through these ports are inspected similar to normal IP
packets in a routing network. The transparent firewall only inspects IP
firewall session is created by using IP Layer 3 and Layer 4 headers that
contain 5-tuple information (5-tuple information are source and destination IP
addresses, source and destination ports, and the protocol). The transparent
firewall supports only Ethernet as a Layer 2 protocol, and supports both IPv4
and IPv6 addresses.
firewall or Layer 3 firewall configuration can be applied to Layer 2 interfaces
for the transparent firewall configuration. Both Layer 3 firewall and Layer 2
transparent firewall can coexist on a device.
firewall supports IP (Internet Control Message Protocol [ICMP], TCP, and UDP)
inspection with the following topologies:
firewall passes the following packets without a policy attached to them:
GigabitEthernet interface and a GigabitEthernet subinterface.
Resolution Protocol (ARP)
packets: Routing Information Protocol (RIP), Open Shortest Path First (OSPF),
OSPF Version 3 (OSPFv3), Enhanced Interior Gateway Routing Protocol (EIGRP)
IPv4 and IPv6 packets, Intermediate System-to-Intermediate System (ISIS) IPv4
and IPv6 packets
Protocol-Independent Multicast (PIM) IPv4 and IPv6 packets
Router Protocol (HSRP), Virtual Router Redundancy Protocol (VRRP), and Gateway
Load Balancing Protocol (GLBP)
Management Protocol (IGMP), and Multicast Listener Discovery (MLD)