I have cisco ASA
5500 firewall and curious can i disable connection tracking for specific rules or protocol.
In short i want to disable connection tracking for
UDP traffic. because UDP is connection less, it doesn't have any state like
NEW, ESTABLISHED etc.. what is the purpose of tracking them. I want to exclude them from my ASA rules.
I have quick check in ASA and following traffic we are inspecting. if there is no UDP/SIP there then who is filling connection table?
policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect netbios inspect tftp inspect icmp
Here is the connection table output, I can see UDP traffic and my SIP port 6050. How can i tell don't track UDP connection?
fw1/act# show conn 366629 in use, 650039 most used UDP outside 220.127.116.11:48145 inside 18.104.22.168:6065, idle 0:00:00, bytes 784, flags - UDP outside 22.214.171.124:11862 inside 126.96.36.199:6065, idle 0:00:00, bytes 796, flags - UDP outside 188.8.131.52:49526 inside 184.108.40.206:6065, idle 0:00:00, bytes 1226, flags - UDP outside 220.127.116.11:46668 inside 18.104.22.168:6065, idle 0:00:00, bytes 814, flags -
UDPis connection less then why i need to track them in ASA to eat connection table?