Transparent Cisco IOS Firewall

Cisco IOS routers can be configured as a layer 2 bridges, this means that you can configure two or more interfaces to be in the same layer 2 domain and that traffic will be switched instead of routed. Another feature that has been added since IOS 12.3(7)T is the transparent Cisco IOS Firewall. This allows traffic filtering and stateful inspection using CBAC for the layer 2 bridge.

When you configure the router as a transparent firewall it will not do any routing and will only learn the MAC addresses on the interfaces and switch frames between the interfaces. The advantage of a transparent firewall is that you can place it at any location in your network without having to change any IP addresses or networking settings like default gateways.

To demonstrate this feature I will use the following topology:

IOS transparent firewall demo topology

Above we have a small network with 3 routers…R1,R2 and R3. R2 will be configured to bridge its Fastethernet 0/0 and 0/1 interfaces together. This means that R1 and R3 will be in the same layer 2 domain.

R1 and R3 will use IPv4 subnet 192.168.13.0 /24 and IPv6 prefix 2001:13::/64. I will configure the firewall with the following requirements:

  • R1 should be able to reach R3 using TCP, UDP and ICMP.
  • R3 is not allowed to send anything to R1 with the exception of return traffic.
  • IPv6 traffic between R1 and R3 is not allowed.

Let’s take a look how to achieve this!

Configuration

First we will configure R2 as a bridge. You have two options here:

  • CRB (Concurrent Routing and Bridging)
  • IRB (Integrated Routing and Bridging)

When you use CRB the router will act as a layer 2 bridge for all interfaces that are in the bridge group and all other interfaces will be layer 3.

With IRB you will be able to configure a BVI (Bridge Virtual Interface) for each bridge group. This is a layer 3 interface for the bridge group and you can compare it to the SVI (Switch Virtual Interface) on Catalyst switches. I’m not going to use any layer 3 services on R2 so I’ll choose CRB:

R2(config)#bridge crb

Bridging is now enabled. Let’s activate spanning-tree:

R2(config)#bridge 1 protocol ieee

This will make the router run the IEEE version of spanning-tree. Let’s continue and add the two interfaces of R2 to the bridge group:

R2(config)#interface fastEthernet 0/0
R2(config-if)#bridge-group 1

R2(config)#interface fastEthernet 0/1
R2(config-if)#bridge-group 1

This finishes our bridge configuration so we can continue with our transparent firewall configuration. First I’ll create an access-list that blocks all IP traffic:

R2(config)#ip access-list extended R3-TO-R1
R2(config-ext-nacl)#deny ip any any

We’ll activate the access-list inbound on the link between R2 and R3:

R2(config)#interface fastEthernet 0/1
R2(config-if)#ip access-group R3-TO-R1 in

To make sure that R1 can reach R3 I’ll create some CBAC inspect rules:

R2(config)#ip inspect name CBAC tcp
R2(config)#ip inspect name CBAC udp
R2(config)#ip inspect name CBAC icmp

This should allow all TCP, UDP and ICMP traffic from R1 to R3. Let’s activate it inbound on the interface pointing to R1:

R2(config)#interface fastEthernet 0/0
R2(config-if)#ip inspect CBAC in

Besides access-lists for IP and inspect rules I can also use protocol access-lists. This will help us to block IPv6 traffic:

R2(config)#access-list 200 deny 0x86DD
R2(config)#access-list 200 permit 0x0 0xFFFF

We’ll deny EtherType 086DD (IPv6) and permit all other EtherTypes. Let’s apply this protocol access-list to the bridge group:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 657 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

541 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags: , ,


Forum Replies

  1. Hi all, I labbed up transparent bridging. R1 is able to ping R3 etc and everything seems to be working, however, when i apply the access-list to the interface fa 0/1 of R2, it seems like it never gets a hit. Traffic continues to flow, there’s no dropping of traffic. any idea why???

  2. so from what i can tell, when the traffic comes back from R3, R2 only looks at the layer 2 information. Since R2 knows the frame is destined for the mac address it switches the frame at layer2. In other words, the ACL is never checked. So how rene did this lab is a mystery to me…
    I’m doing the lab in gns3 using Cisco IOS Software, 3700 Software (C3725-ADVENTERPRISEK9-M), Version 12.4(25)

  3. Hello Kam

    Pinging from R1 to R3 will work whether you have the access list applied to Fa0/1 or not, as the access list will allow traffic from R1 to R3 as well as responding traffic. Try pinging from R3 to R1 to see if the access list is blocking.

    Now it is true that the access list is applied to a layer 2 interface, however, access lists that are configured to inspect tcp, udp and icmp as is the case here will also check higher level protocols to determine if a frame can be forwarded or should be dropped.

    Let us know of your results and if need be, we can hel

    ... Continue reading in our forum

  4. Hi Lagapides

    According wording “This means that R1 and R3 will be in the same layer 2 domain.” , it mean if Braodcast strom happen from R1 then it effect with R3 right ?
    If Yes, How we limited Broadcast storm ?.
    We can configuration STORM CONTROLL BROADCAST LEVEL AS CISCO SWITCH ?

  5. Hi aujla3,

    I lab it up & I too notice access list R3-TO-R1 is not hit. CBAC also shows no traffic.
    On R2:

    interface FastEthernet0/0
     no ip address
     ip inspect CBAC in
    
    interface FastEthernet0/1
     no ip address
     ip access-group R3-TO-R1 in
    
    ip access-list extended R3-TO-R1
     deny   ip any any
    
    ip inspect name CBAC tcp
    ip inspect name CBAC udp
    ip inspect name CBAC icmp
    
    R3#ping 192.168.13.1
    
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.13.1, timeout is 2 seconds:
    !!!!!
    
    R2#show access-list R3-TO-R1
    Extended IP access list R3-TO-R1
        10
    ... Continue reading in our forum

2 more replies! Ask a question or join the discussion by visiting our Community Forum