# Cisco ASAv Transparent mode in Vmware Esxi



## rezafathi (Nov 19, 2015)

Hello,

we have a Esxi server with 15 VMs installed and i wanted to deploy Cisco ASAv in transparent mode. The problem is when i config the asa and power it on the whole network and VMs connectivity will be lost. I used an IP address in the VMs network range in cisco asa and should mention that esxi server has only one NIC. So please help me to solve this problem. Thanks


----------



## MitchConner (May 8, 2015)

Hi mate,

What are you setting the gateways for your vm's as?


----------



## MitchConner (May 8, 2015)

edit:

After re-reading, I think I see what you're trying to do. An ASA in transparent mode operates at layer 2 only with the IP address of the ASA used as management only. You can't use it as a layer 3 hop in the network.


----------



## rezafathi (Nov 19, 2015)

i wanted asa to filter traffics going in and out. so what should i do?


----------



## MitchConner (May 8, 2015)

You can still use it the way you want but you can't point your vms at it as a default gateway mate. Unless there is a specific reason for you to have it in transparent mode, put it back into routed.


----------



## rezafathi (Nov 19, 2015)

because of the data center policy we can not deploy it as routed mode. we have a range lets say 192.168.1.0/24 assigned to us and the 192.168.1.1 which is gateway for VMs is data center's router or firewall. I just wanted to put asa in between to control our VMs traffics.


----------



## rezafathi (Nov 19, 2015)

I did not point our VMs to ASA in transparent mode. i just gave it for exmaple 192.168.1.100/24 for the managenet interface but when i power it on the whole network connection fails and if i turn it off everything works again.


----------



## MitchConner (May 8, 2015)

If the firewall or router is going to be the layer 3 gateway you can use an address in the range, but you can't use an intermediate firewall in transparent mode and use it as the vm's default gateway as it operates at layer 2 but it can filter at layer 3.

edit: when you turn it on and everything fails, you still need to add routes and access-lists to the asa.


----------



## rezafathi (Nov 19, 2015)

mate, thank you. but again i did not point our vms to asa. i just gave an address in range to its management interface that's it.


----------



## MitchConner (May 8, 2015)

The problem is is that you're not giving me enough information to help you mate. If you have the default gateway as a router or firewall beyond the transparent firewall, you still need to add access-rules in order for it to work, and you'll need to add routes for management traffic on the asa or anything that originates from the asa itself.

If you are merely filtering traffic to your vm's, there is no point going in transparent mode when you can achieve everything you need with routed mode without the added complexity, and you don't have the vm and management ip's in the same subnet.


----------



## rezafathi (Nov 19, 2015)

The default gateway is at the data-center side so i want to control traffics myself. for the first time setup i create an access-list to allow all incoming and outgoing traffics and also created and static route pointed to the default gateway so i can access ASA. The esxi server has only one NIC and i created 2 vm port groups one for all vms and one for the asa outside interface. I also tried to set the inside and outside interface with same port group but no success.


----------



## rezafathi (Nov 19, 2015)

I know that all vms should connect to ASA's inside intetface and the outside interface should connect to datacenter but i'm not sure what is wrong and what causes the problem.


----------



## MitchConner (May 8, 2015)

Can you show me your config?


----------



## rezafathi (Nov 19, 2015)

Sorry i had to take screenshot.


----------



## MitchConner (May 8, 2015)

Your last picture shows your interfaces as down down mate, check your cabling.


----------



## rezafathi (Nov 19, 2015)

yes i disconnected these interfaces myself to avoid network problems


----------



## rezafathi (Nov 19, 2015)

when i connect them the esxi server and it's all vms will loose connectivity


----------

