1

I have cisco ASA 5500 firewall and curious can i disable connection tracking for specific rules or protocol.

In short i want to disable connection tracking for UDP traffic. because UDP is connection less, it doesn't have any state like NEW, ESTABLISHED etc.. what is the purpose of tracking them. I want to exclude them from my ASA rules.

UPDATE

I have quick check in ASA and following traffic we are inspecting. if there is no UDP/SIP there then who is filling connection table?

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect icmp

Here is the connection table output, I can see UDP traffic and my SIP port 6050. How can i tell don't track UDP connection?

fw1/act# show conn
366629 in use, 650039 most used
UDP outside 188.16.1.180:48145 inside 63.91.252.112:6065, idle 0:00:00, bytes 784, flags -
UDP outside 93.170.181.204:11862 inside 63.91.252.112:6065, idle 0:00:00, bytes 796, flags -
UDP outside 194.44.127.194:49526 inside 63.91.252.112:6065, idle 0:00:00, bytes 1226, flags -
UDP outside 5.166.44.120:46668 inside 63.91.252.112:6065, idle 0:00:00, bytes 814, flags -
4
  • What are you trying to accomplish, exactly? The UDP connection timeout on an ASA is 2 minutes. Is there something that is not working as a result of connection tracking? Perhaps are you more interested in disabling inspection or protocol enforcement for certain UDP protocols?
    – Eddie
    Dec 9, 2015 at 23:26
  • We have UDP base application like SIP. And majority time my connection table is full because on ASA. I just want to say ASA don't do connection tracking for UDP or SIP anything.
    – Satish
    Dec 10, 2015 at 2:59
  • Anybody know about this issue? UDP is connection less then why i need to track them in ASA to eat connection table?
    – Satish
    Dec 10, 2015 at 17:26
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 6, 2017 at 23:01

1 Answer 1

2

By default, the ASA inspects SIP and many other protocols as you can see listed below.

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 

To remove unwanted inspection, go into the policy-map and remove the inspect command.

policy-map global_policy
 class inspection_default
  no inspect sip 

Please be aware that this will kill the existing connections so this should be done off hours or during a maintenance window.

9
  • You mean say if i remove SIP from inspection list then it will stop tracking SIP connection? Does my SIP traffic will pass through the firewall after removing inspection? In short i don't want connection tracking but i need basic firewall function. We have many SIP server behind so want to make sure they will functional after removing inspection
    – Satish
    Dec 10, 2015 at 19:35
  • 1
    SIP will still function as long as you have your permit rules as needed on your ACL's. When you stop inspecting SIP, the firewall will stop trying tracking your SIP connections and permit them through the same as other non inspected traffic. You should also contact your SIP provider to see if they recommend disabling SIP ALG Dec 10, 2015 at 19:49
  • Does ASA inspection work base on know port like for SIP 5060 ? because we are running SIP on 6065, how inspection work?
    – Satish
    Dec 10, 2015 at 20:00
  • I have updated my question, take a look
    – Satish
    Dec 10, 2015 at 20:13
  • The ASA keeps a connection table for UDP connections to dynamically allow connections initiated from the inside to get a reply from the outside without getting blocked by the ASA. This is the nature of a stateful firewall. Dec 10, 2015 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.