I have cisco ASA 5500
firewall and curious can i disable connection tracking for specific rules or protocol.
In short i want to disable connection tracking for UDP
traffic. because UDP is connection less, it doesn't have any state like NEW, ESTABLISHED
etc.. what is the purpose of tracking them. I want to exclude them from my ASA rules.
UPDATE
I have quick check in ASA and following traffic we are inspecting. if there is no UDP/SIP there then who is filling connection table?
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect netbios
inspect tftp
inspect icmp
Here is the connection table output, I can see UDP traffic and my SIP port 6050. How can i tell don't track UDP connection?
fw1/act# show conn
366629 in use, 650039 most used
UDP outside 188.16.1.180:48145 inside 63.91.252.112:6065, idle 0:00:00, bytes 784, flags -
UDP outside 93.170.181.204:11862 inside 63.91.252.112:6065, idle 0:00:00, bytes 796, flags -
UDP outside 194.44.127.194:49526 inside 63.91.252.112:6065, idle 0:00:00, bytes 1226, flags -
UDP outside 5.166.44.120:46668 inside 63.91.252.112:6065, idle 0:00:00, bytes 814, flags -
UDP
is connection less then why i need to track them in ASA to eat connection table?