CloudLabBox
Try the free demo

Cisco ASA lab 14 of 15

Transparent (Layer 2) firewall: bridge groups, BVI and letting OSPF through

Insert an ASA into an existing routed link without re-addressing anything: switch to transparent mode, bridge inside and outside in one bridge group, manage it through a BVI, then write the ACLs that let OSPF and a web service through while everything else stays blocked.

Run this lab

It needs Lite: its 3 nodes are set to 3 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 14 - Transparent - Layer 2 firewall - bridge groups BVI and letting OSPF through

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
3 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Kestrel's data-centre router CORE and the WAN router are in the same subnet, 10.50.50.0/24, and run OSPF with each other. The auditors want a firewall between the data centre and the WAN, but re-addressing the link would mean a change to every branch. The answer is a transparent firewall: L2-FW sits in the cable like a bump in the wire, both routers keep their addresses, and OSPF keeps running through it.

Policy for traffic entering from the WAN side: OSPF (so routing keeps working), ping to the data centre, and HTTP to the data-centre server range 10.60.60.0/24. Nothing else. The data centre may start anything towards the WAN.

What you’ll practise

  • Explain routed versus transparent firewall deployment and when to use each
  • Convert an ASA to transparent mode and configure a bridge group with a BVI
  • Permit OSPF, which uses multicast, through a transparent firewall
  • Control traffic with ACLs on bridged interfaces and read the MAC address table

The tasks

  1. Before the firewall
  2. Transparent mode and the bridge group
  3. Let OSPF through
  4. The WAN-side policy
  5. Look inside the bridge

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Transparent - Layer 2 firewall - bridge groups BVI and letting OSPF through3 nodes, 2 links. Every link is listed as text below the diagram.L2-FWCOREWANGi0/0Gi0/0Gi0/1Gi0/0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • CORE Gi0/0 to L2-FW Gi0/0
  • L2-FW Gi0/1 to WAN Gi0/0
Nodes in Transparent (Layer 2) firewall: bridge groups, BVI and letting OSPF through, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
L2-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
CORECisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
WANCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 14 - Transparent - Layer 2 firewall - bridge groups BVI and letting OSPF through and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.