How to Configure New ASA 5510 in Transparent Mode?

2023 SEASON SALE Networking and Security Showcase In-stock ICT products at exclusive discounts

How to configure ASA in transparent mode instead of routing mode in an existing network? Here we will share a Cisco ASA user’ real example of Configuring New ASA 5510 in Transparent Mode.

The REAL Problem: User is new to ASA’s, he got a new asa 5510 (actually a refurb) and need to get it setup into existing network, He read it would be easier to put it in transparent mode than routing mode if you have an existing network and dont wanna redo the whole thing.

Current Setup right now is:

internet > cisco leased router(with a set of external ip’s from ATT) > juniper ns25( internal set of ip’s mipped with the external) > internal network. So far user have put the asa in transparent mode and got the basics configured reading from some of the docs here and even some youtube vids, user read the docs on transparent mode for the ASA’s

Question is on the BVI 1, it doesn’t allow user to put the same ip range as his internal, it needed a different one like right now user have on it.

Here’s running config:

crxasa# sh run

ASA Version 9.1(2)8


firewall transparent

hostname crxasa


enable password jtiwndTuzIDdTcxA encrypted



interface Ethernet0/0

nameif outside

security-level 0


interface Ethernet0/1

nameif inside

security-level 100


interface Ethernet0/2


no nameif

no security-level


interface Ethernet0/3


no nameif

no security-level


interface Management0/0


nameif management

security-level 100

ip address


interface BVI1

ip address


boot system disk0:/asa912-8-k8.bin

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns server-group DefaultDNS


pager lines 24

logging enable

logging asdm informational

mtu management 1500

mtu outside 1500

mtu inside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-714.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

http server enable

http management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh management

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username admin password 571.UcWz1aqKyGh3 encrypted


class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options


service-policy global_policy global

prompt hostname context

no call-home reporting anonymous


: end

The Final Solution:

User need to do this over console, what you can do to  avoid getting disconnected is the next, when you have a laptop connected to the ASA and not through your network

Reload the ASA, it will come back up with the previous  configuration if you saved it; log into the unit and instead of  removing the IP address from the interface Management0/0 overwrite it  and also remove the IP address from the BVI, follow this example:


config t

interface BVI1

no ip address


config t

interface Management0/0

ip address

You will lose connection for a moment but as soon as  you reconfigure your LAN adapter to the network you  should be able to connect.

To reconfigure the BVI to the network that you need:


config t

interface BVI1

ip address <IP_address> <netmask>

Topic Discussion you can see at:

More Cisco ASA Topics:

How to Configure Dual ISP on Cisco ASA 5505?

How to Configure Cisco ASA 5505 Firewall?

Configuring Static NAT on a Cisco ASA Security Appliance

Cisco ASA 5520 Basic Configuration Guide

Share This Post

Post Comment