Cisco ASA 5505 - Manual (Page 186)

4-14
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 4 Configuring the Transparent or Routed Firewall
Customizing the MAC Address Table for the Transparent Firewall
Information About the MAC Address Table
The ASA learns and builds a MAC address table in a similar way as a normal bridge or switch: when a
device sends a packet through the ASA, the ASA adds the MAC address to its table. The table associates
the MAC address with the source interface so that the ASA knows to send any packets addressed to the
device out the correct interface.
The ASA 5505 includes a built-in switch; the switch MAC address table maintains the MAC
address-to-switch port mapping for traffic within each VLAN. This section only discusses the bridge
MAC address table, which maintains the MAC address-to-VLAN interface mapping for traffic that
passes between VLANs.
Because the ASA is a firewall, if the destination MAC address of a packet is not in the table, the ASA
does not flood the original packet on all interfaces as a normal bridge does. Instead, it generates the
following packets for directly connected devices or for remote devices:
• Packets for directly connected devices—The ASA generates an ARP request for the destination IP
address, so that the ASA can learn which interface receives the ARP response.
• Packets for remote devices—The ASA generates a ping to the destination IP address so that the ASA
can learn which interface receives the ping reply.
The original packet is dropped.
Licensing Requirements for the MAC Address Table
The following table shows the licensing requirements for this feature.
Default Settings
The default timeout value for dynamic MAC address table entries is 5 minutes.
By default, each interface automatically learns the MAC addresses of entering traffic, and the ASA adds
corresponding entries to the MAC address table.
Guidelines and Limitations
Context Mode Guidelines
• Supported in single and multiple context mode.
• In multiple context mode, configure the MAC address table within each context.
Firewall Mode Guidelines
Supported only in transparent firewall mode. Routed mode is not supported.
Model License Requirement
All models Base License.