5

I have a CISCO ASA 5506-X with 4 configured interfaces and a set of access-lists etc. It is configured via CLI and is running in routed mode, not transparent. Everything is running well, but now I have a problem I could not yet solve:

One of the interfaces contains a subnet (192.168.2.*) with devices that send out a UDP broadcast to discover another kind of devices. Those other devices are in another subnet in another interface (192.168.3.*). The udp broadcast is global (255.255.255.255) on a certain port.

I want the global UDP broadcast sent out in 192.168.2.* to also be sent to 192.168.3.* - and to allow the way back as well, of course.

On other Cisco devices, I already found out that one can do that with ip helper-address and ip forward-protocol commands - but the ASA models do not support those, as far as I can see.

So, how do I get the global UDP broadcast across the interfaces?

  • Do the devices support other discovery mechanisms such as AD integration, multicast (UPnP, mDNS, Bonjour) ? – Tricky Dec 22 '15 at 11:03
3
+50

I think the issues here is that you misunderstand what 255.255.255.255 means. Its not a "global Broadcast". The definition from the RFC (https://tools.ietf.org/html/rfc919):

"The address 255.255.255.255 denotes a broadcast on a local hardware network, which must not be forwarded. This address may be used, for example, by hosts that do not know their network number and are asking some server for it. Thus, a host on net 36, for example, may:

  • broadcast to all of its immediate neighbors by using 255.255.255.255
  • broadcast to all of net 36 by using 36.255.255.255

In your case a host 192.168.3.0/24 sending a broadcast to 255.255.255.255 is saying is please send this to all hosts in 192.168.3.0/24. This is the same as sending a packet to 192.168.3.255. If a host in .3 wants to send a broadcast to .2 it needs to send a packet to 192.168.2.255. Having broadcasts from .3 rebroadcasted into .2 is essentially saying you want to make them the same subnet whilst keeping them as different subnets. (the common other name for a subnet is a "broadcast domain")

What the ip helper and ip forward-protocol and the ASAs dhcprelay commands do is to capture the broadcast packet and forward it as a unicast packet to a specific host. normally a remote DHCP server but there are other uses. This is explicitly stated in first paragraph of the Checkpoint doc linked in the previous answer. It could be thought of as a kind of NAT. ie the destination address (255.255.255.255) is changed to a specified unicast IP, 192.168.3.10. and then routed as a normal unicast packet. This works great for DHCP and allows the DHCP server to be in a remote network and still receive and respond to DHCP requests but unfortunately even if the ASA supported the ip helper and ip forward-protocol commands it still couldn't solve your problem. What your asking violates the RFC and the definition of what a subnet is.

The easiest solution here is to merge the 2 subnets into 192.168.2.0/23 then bridge the 2 interfaces and use the ASA in transparent mode to filter traffic between the 2 sets of hosts.

If you can't do that that then you need to work out a more scalable way for your devices to find each other. Either sending broadcasts to their subnets respective broadcast addresses (192.168.3.255 and 192.168.2.255) or using some other Discovery method. 255.255.255.255 isn't a scalable or flexible solution.

| improve this answer | |
  • 1
    Yes, I understand, but the CP firewall is actually quite happy to let you abuse the unicast address field by filling in a directed broadcast address such as 192.168.2.255. Its not pretty but is seems to work just fine (so long as you don't block directed broadcasts). – Tricky Dec 20 '15 at 16:51
  • My comment about missunderstanding is about the OP rather than you. He could potentially do that forwarding in both directions but broadcast from .2 will arrive in .3 destined for 192.168.3.255 in this case whatever app he is running would need to be listening for it. – Nath Dec 21 '15 at 8:22
2

There is no feature for this in the current version (probably for security reasons). Cisco implemented "dhcprelay" instead and didn't provide a means for more general broadcast forwarding.

I'd suggest adding another device outside the ASA FW that could perform the same role (A Cisco router or a Linux machine perhaps). You will need to allow "directed broadcast" through the ASA.

You might also consider using a different firewall platform which does support broadcast relay, for example a Checkpoint Firewall.

Look here to see how its configured

| improve this answer | |
  • So you mean creating a handmade "broadcast relay" that receives the broadcast in one subnet and repeats it in the other subnets? Neat idea. Its a shame there does not seem to be a better solution. – Steffen Müller Dec 18 '15 at 10:40
  • Yes, that's exactly what I'm suggesting. There probably is a better way but I'm not aware of it unless you are open to replacing the ASA with something else. I'll adjust my answer accordingly. – Tricky Dec 19 '15 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.