Transparent Mode. Module Objectives By the end of this module participants will be able to: Describe...
-
Upload
edmund-welch -
Category
Documents
-
view
231 -
download
0
Transcript of Transparent Mode. Module Objectives By the end of this module participants will be able to: Describe...
Transparent Mode
Module Objectives
• By the end of this module participants will be able to:• Describe FortiGate unit operating modes
• Describe how VLANs are used on a FortiGate unit operating in Transparent Mode
• Configure a VDOM in Transparent Mode
Operating Modes
• The operating mode of the FortiGate unit defines how traffic is forwarded by the device• The FortiGate unit can operate in one of two modes:• NAT/Route Mode• The FortiGate unit processes and routes traffic using layer-3 IP
headers• The destination IP address is used to forward the packet
• Transparent Mode• The FortiGate unit acts as transparent bridge and routes traffic
using layer-2 forwarding• Ethernet packets are forwarded based on destination MAC addresses
• The device is transparent to network hosts
• Permits inline traffic inspection and firewalling without changing the IP scheme of the network
Operating Modes – NAT/Route
Internet
wan1204.23.1.5
internal192.168.1.99
dmz10.10.10.1
192.168.1.3
10.10.10.2
Routing policies control traffic
between internal networks
NAT mode policies control traffic
between internal and external networks
Click here to read more about FortiGate operating modes
Operating Modes – Transparent
Internet
internal
10.10.10.1
Gateway topublic network
204.23.1.5
wan1
10.10.10.3
Click here to read more about FortiGate operating modes
DestinationMAC
SourceMAC
Type Data CRC32
(6 bytes) (6 bytes) (2 bytes) (46 - 1500 bytes) (4 bytes)
Ethernet Frame
Click here to read more about interpreting Ethernet headers
DestinationMAC
SourceMAC
Type Data CRC32
(6 bytes) (6 bytes) (2 bytes) (46 - 1500 bytes) (4 bytes)
TagControl
Info
(2 bytes)
Type
(2 bytes)
8100 0800
VLAN Tags
VLAN tags
interfaces=[port5]filters=[ ]0.793493 port5 -- 802.1Q vlan#101 P0 haven't been added to sniffer0x0000 0009 0f0b a1c2 0009 0f09 0605 8100 0065 ...............e0x0010 0800 4500…
Interpreting Ethernet Headers
IP DataTypeTag Control Information802.1 Tag TypeSource MAC addressDestination MAC address
interfaces=[port5]filters=[ ]0.793493 port5 -- 802.1Q vlan#101 P0 haven't been added to sniffer0x0000 0009 0f0b a1c2 0009 0f09 0605 8100 0065 ...............e0x0010 0800 4500…
Interpreting Ethernet Headers
VLANs on a FortiGate Unit in Transparent Mode
• FortiGate units can act as a layer-2 switch when in transparent mode• The device can tag and forward VLAN traffic or can
receive and remove the tag
• Provides antivirus, web filtering, spam filtering and IPS services on IEEE 802.1Q VLAN trunk• FortiGate device in transparent mode can be inserted
into the trunk without making any changes to the network
VLANs on a FortiGate Unit in Transparent Mode
VLAN 100
Branch office
VLAN 200
Headquarters
Tag: VLAN 100 Tag: VLAN 100
Switch A Switch B
Subnet 1 Subnet 2
FortiGate unit operating in Transparent
Mode
VLAN 100 VLAN 200
Port 1-4 Port 5-7 Port 6 Port 4-5802.1Qtrunklink
Click here to read more about VLANs on a FortiGate running in Transparent mode
Port Pairing
• Binds two ports together when the FortiGate unit is operating in transparent mode• Can create firewall policies that regulate traffic only
between two specific ports, VLANs or VDOMs.
• Traffic is captured between these ports• No other traffic can enter or leave a port pairing
Port Pairing
FortiGate unit operating in Transparent
Mode
Port1
Internet
Port2
Port3
Wan1
Port Pair → Exclusive Traffic
Transparent Bridge
• Transparent bridging allows a switch to learn about the location of nodes on the network• The presence and operation of the bridge is
transparent to network hosts
• Builds a table for traffic forwarding by analyzing the source addresses of incoming frames from attached networks• Intra-segment traffic is isolated• Reduces traffic seen on individual segments
• Can improve network response time
Click here to read more about transparent bridging
Broadcasting Domain
• A broadcast domain is a network segment in which any networking equipment can transmit data directly to another device without going through a routing device• All devices can be reached by sending a simple frame
to the broadcast address
• All devices share the same subnet, use the same gateway and are in the same VLAN• All devices detect frame transmission, but only the devices to which frame is addressed receive it
Click here to read more about broadcast domains
Broadcasting Domain
FortiGate unit operating in Transparent
Mode
ARP broadcast onVLAN101_wan1
VLAN102_dmz
VLAN104_dmz
Port 1
VLAN101_wan1
VLAN103_dmz
VLAN101_internal
Forwarding Domain
• Forwarding domains allow separate broadcast domains to be maintained per VLAN• Packets are contained and only broadcast between
interfaces in the same VLAN
Click here to read more about forwarding domains
Forwarding Domain
FortiGate unit operating in Transparent
Mode
ARP broadcast onVLAN101_wan1
VLAN102_dmz
VLAN104_dmz
Port 1
VLAN101_wan1
VLAN103_dmz
VLAN101_internal
config sys interfaceedit VLAN101_wan1set forward-domain 101end
config sys interfaceedit VLAN101_internalset forward-domain 101end
VLAN101_internalVLAN101_wan1
Forwarding domain 101
Spanning Tree Protocol
• Spanning Tree Protocol is a link management protocol that provides path redundancy and ensures a loop free topology• Allows a network design to include redundant links in tree-like structure that spans all switches• If one network segment in the tree becomes
unreachable, the algorithm reconfigures the spanning-tree topology
• All switches gather information on other switches through an exchange of Bridge Protocol Data Unit (BPDU) data messages• The FortiGate unit will forward or block (the default
setting) BPDUs
Click here to read more about Spanning Tree Protocol
Link Aggregation
• Link aggregation describes the use of Ethernet network cables and ports in parallel to increase the link speed beyond the limits of single cable or port• Increases the redundancy for higher availability
• Bundles several physical ports to form a single logical channel
• A FortiGate unit operating in transparent mode can be inserted into aggregate link
Click here to read more about link aggregation
Link Aggregation
Gateway router:172.16.1.254
interface GigabitEthernet1/1no ip addressswitchportchannel-group 1 mode active!interface GigabitEthernet2/1no ip addressswitchportchannel-group 1 mode active
GE1/1
GE2/1
Port1
Port2
config sys interfaceedit “link_agg”set vdom “root”set ip 172.16.1.2 255.255.255.0set type aggregateset member “port1” “port2”end
Student Resources
Click here to view the list of resources used in this module