2

As you know, packets flow from higher security level interfaces to lower ones by default. If you want to have an operational connection between two interfaces, your ASA must inspect the traffic so that it won't drop the connections initiated from inside.

For example, if I want ping to work I must inspect ICMP.

Here is the question: What if I have a computer outside listening on an arbitrary port, and I want to connect to that computer from inside (obviously from a randomly generated port by OS)?

Packets can get from inside to outside because of security levels, but since ASA doesn't inspect the traffic will it drop the return packets from outside to inside?

3

It won't drop the packets, because the ASA is a Stateful device.

First, you have to understand what I mean when I say the ASA is a stateful device. This means if the firewall allowed traffic in the direction outbound, it automatically allows the correlating return traffic back inbound -- even if the inbound ACL or Security-Level would have prevented all traffic inbound.

As for ICMP, by default, ICMP is not stateful. Which is to say, if you want to allow ICMP packets to leave your network, you must explicitly allow it (via ACL or Security-Level). And if you intend for ICMP packets to come back into your network, you must also explicitly allow it.

However, you can override that default behavior by enabling ICMP inspection. On the ASA inspecting ICMP makes the ASA consider ICMP stateful. Which means, if it allows an ICMP Echo Request leave your network, it will automatically allow the ICMP Echo Response come back into your network.

2
  • tnx man, it was really useful, I have this problem with the ASA I'm running on gns3. It seem not to be working correctly. I have set up a dhcp server for one of my interfaces (which is pretty much straight forward) but it doesn't hand out IPs. nat also seems not to be working properly. Is it the emulator or I am doing sth wrong? – ashkan Jan 15 '15 at 9:03
  • Sounds like you need more help beyond just this question. If its specific, I would encourage you to create another question (and post all the relevant configurations, etc). If its a bunch of different things, I would encourage you to ask them in the chat room. – Eddie Jan 15 '15 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.