D-Link NetDefendOS, User Manual

Page: 381 / 912

How Transparent Mode Functions
In transparent mode, NetDefendOS allows ARP transactions to pass through the NetDefend
Firewall, and determines from this ARP traffic the relationship between IP addresses, physical
addresses and interfaces. NetDefendOS remembers this address information in order to relay IP
packets to the correct receiver. During the ARP transactions, neither of the endpoints will be
aware of the NetDefend Firewall.
When beginning communication, a host will locate the target host's physical address by
broadcasting an ARP request. This request is intercepted by NetDefendOS and it sets up an
internal ARP Transaction State entry and broadcasts the ARP request to all the other switch-route
interfaces except the interface the ARP request was received on. If NetDefendOS receives an ARP
reply from the destination within a configurable timeout period, it will relay the reply back to the
sender of the request, using the information previously stored in the ARP Transaction State entry.
During the ARP transaction, NetDefendOS learns the source address information for both ends
from the request and reply. NetDefendOS maintains two tables to store this information: the
Content Addressable Memory (CAM) and Layer 3 Cache. The CAM table tracks the MAC
addresses available on a given interface and the Layer 3 cache maps an IP address to MAC
address and interface. As the Layer 3 Cache is only used for IP traffic, Layer 3 Cache entries are
stored as single host entries in the routing table.
For each IP packet that passes through the NetDefend Firewall, a route lookup for the destination
is done. If the route of the packet matches a Switch Route or a Layer 3 Cache entry in the routing
table, NetDefendOS knows that it should handle this packet in a transparent manner. If a
destination interface and MAC address is available in the route, NetDefendOS has the necessary
information to forward the packet to the destination. If the route was a Switch Route, no specific
information about the destination is available and the firewall will have to discover where the
destination is located in the network.
Discovery is done by NetDefendOS sending out ARP as well as ICMP (ping) requests, acting as the
initiating sender of the original IP packet for the destination on the interfaces specified in the
Switch Route. If an ARP reply is received, NetDefendOS will update the CAM table and Layer 3
Cache and forward the packet to the destination.
If the CAM table or the Layer 3 Cache is full, the tables are partially flushed automatically. Using
the discovery mechanism of sending ARP and ICMP requests, NetDefendOS will rediscover
destinations that may have been flushed.
Enabling Transparent Mode
To enable NetDefendOS transparent mode, the following steps are required:
1. The interfaces that are to be transparent should be first collected together into a single
Interface Group object. Interfaces in the group should be marked as Security transport
equivalent if hosts are to move freely between them.
2. A Switch Route is now created in the appropriate routing table and the interface group
associated with it. Any existing non-switch routes for interfaces in the group should be
removed from the routing table.
For the Network parameter in the switch route, specify all-nets or alternatively, specify a
network or range of IP addresses that will be transparent between the interfaces (this latter
option is discussed further below).
3. Create the appropriate IP rules in the IP rule set to allow the desired traffic to flow between
the interfaces operating in transparent mode.
If no restriction at all is to be initially placed on traffic flowing in transparent mode, the
Chapter 4: Routing
381