x mode. Chapter 28: ASA Firewall Configuration All model ASAs can be configured to run in transparent mode. In this mode, the ASA becomes a bridge and a bump on the wire, which is, in my opinion, about the dumbest description ever. Transparent mode is available SO that you can drop your firewall into an existing network without renumbering any part of it. With only an IP address for man- agement, a transparent firewall seems like the perfect solution. I'm sure I'll get heat for this, but I recommend that you don't use trans- parent mode. Every installation I've ever seen where transparent mode ASAs or PIXes were involved has been a disaster. Why? Because the proper solution involved redesigning the network, and no one was will- ing to spend the time and/or money to do SO. Transparent firewalls allow a solution to be shoe-horned into a network that wasn't designed for a firewall. Do yourself a favor and insist that the network be redesigned to support the traditional Layer-3 firewall model instead of using trans- parent mode. On the ASA 5540, the standard physical interfaces are G0/0 through G0/3. An expan- sion card can be installed to add interfaces, which are numbered incrementally starting at G1/0. Each interface must be assigned a logical name. There are no default names for interfaces on an ASA, but inside and outside have special meaning. Each interface must also have a security level assigned. By default, interfaces with higher security levels can send packets to interfaces with lower security levels, but interfaces with lower security levels cannot send packets to interfaces with higher security levels. An interface's security level is represented by an integer within the range 0-100. The default security level for the inside interface is 100. The default security level for the outside interface is 0. On an ASA, when you assign the name outside or inside, it will assign the proper security level for you: ASA-5540/GAD(config-if)# nameif outside INFO: Security level for "outside" set to 0 by default. If you