Transparent Mode; Overview - D-Link NetDefendOS User Manual

4.8. Transparent Mode

4.8.1. Overview

Transparent Mode Usage
The NetDefendOS Transparent Mode feature allows a NetDefend Firewall to be placed at a point
in a network without any reconfiguration of the network and without hosts being aware of its
presence. All NetDefendOS features can then be used to monitor and manage traffic flowing
through that point. NetDefendOS can allow or deny access to different types of services (for
example HTTP) and in specified directions. As long as users are accessing the services permitted,
they will not be aware of the NetDefend Firewall's presence.
Network security and control can therefore be significantly enhanced with deployment of a
NetDefend Firewall operating in transparent mode but while disturbance to existing users and
hosts is minimized.
Switch Routes
Transparent mode is enabled by specifying a Switch Route instead of a standard Route in routing
tables. The switch route usually specifies that the network all-nets is found on a specific interface.
NetDefendOS then uses ARP message exchanges over the connected Ethernet network to
identify and keep track of which host IP addresses are located on that interface (this is explained
further below). There should not be a normal non-switch route for that same interface.
In certain, less usual circumstances, switch routes can have a network range specified instead of
all-nets. This is usually when a network is split between two interfaces but the administrator does
not know exactly which users are on which interface.
Broadcast Packet Forwarding
By default, broadcast packets will not be forwarded with transparent mode. Forwarding must be
switched on by enabling the property Forward broadcast packets on switch routes and this must
be done for the routes for both the source and destination interface. This is explained further in
Section 4.2.7, "Broadcast Packet Forwarding".
Usage Scenarios
Two examples of transparent mode usage are:
Note: HA does not support transparent mode
There is no state synchronization for switch routes and therefore transparent mode in a
NetDefendOS high availability cluster. Loop avoidance will not function at all. For these
reasons, transparent mode should not be configured in an HA cluster.
Note:IPv6 is not supported in switch routes
Although IPv6 is supported in normal NetDefendOS routes, it is not supported in switch
routes. This means that IPv6 cannot be used with transparent mode.
379
Chapter 4: Routing