Objectives
The simulator ticks each one as soon as the network meets it.
Make the firewall transparent: firewall transparent.
Put Gi0/0 (inside, level 100) and Gi0/1 (outside, level 0) in bridge group 1, and bring them up.
Give BVI1 the management address 192.168.1.5/24. PC1 can ping it.
Add inspect icmp, so PC1 reaches 198.51.100.1 behind R1.
R1 still cannot start a ping to PC1, and show bridge-group and show mac-address-table show what the bridge has learned.
Before you start
Nothing changes for PC1: its gateway is still R1. Changing the firewall mode clears the configuration, so do it first. An interface in a bridge group has no address of its own; only the BVI does.
Concept
A transparent firewall: filtering without routing
A transparent firewall sits in a cable inside one subnet and bridges, so neither side changes its addresses or gateway. It still checks every frame against security levels, access rules and inspection. Member interfaces have no address; a bridge group’s BVI holds the one management address.
Concept
Firewall security levels and stateful inspection
Each firewall interface has a name and a security level from 0 to 100. Traffic may flow from a higher level to a lower one; the other way needs an access rule. The firewall remembers the connections it allowed, so their replies come back, but an ICMP echo reply only counts as a reply when ICMP is inspected.
