D-Link DFL-1600 User Manual page 305

27.2. Transparent Mode Implementation in D-Link Firewalls
Create a Switch Route – as interface, select the interface group
created earlier. As network, specify the address range that should be
transparent between the interfaces. When the whole firewall is
working in Transparent Mode this is normally 0.0.0.0/0.
When initiating communication, a host will locate the other host's physical
address by broadcasting an ARP request. When the firewall intercepts an
ARP request, it sets up an ARP Transaction State inside the firewall and
broadcasts the ARP request to all the other switch-route interfaces except
the interface the ARP request was received on. If the firewall receives an
ARP reply from the destination within a three second timeout, it will relay
the reply back to the sender of the request, using information stored in the
ARP Transaction State.
During the ARP transaction, the firewall learns the source address
information of both ends from the request and reply. Inside the D-Link
firewall, two tables are maintained that are used to store such information,
called Content -Addressable Memory(CAM) Table and Layer 3 Cache
respectively.
The CAM table contains information of the MAC addresses available on a
given physical interface of the firewall, while the Layer 3 cache stores
mappings between IP address, MAC address and interface.
As the Layer 3 Cache is only used for IP traffic, Layer 3 Cache entries are
stored as single host entries in the routing table.
For each IP packet that will traverse the firewall, a route lookup for the
destination will be done. If the route of the packet matches a switch route
or a Layer 3 Cache entry in the routing table, the firewall knows that it
should handle this packet in a transparent manner. If a destination
interface and MAC address is available in the route, the firewall has the
necessary information to forward the packet to the destination. If the route
was a switchroute, no specific information about the destination is available
and the firewall will have to discover where the destination is located in the
network. Discovery is done by sending out ARP requests, acting as the
initiating sender of the original IP packet for the destination on the
interfaces specified in the switchroute. If an ARP reply is received, the
firewall will update the CAM table and Layer 3 Cache and forward the
packet to the destination.
D-Link Firewalls User's Guide
285