Default Stateful nature of Cisco ASA not working. What should I look for? [closed]

Question

Scenario: Host A (trusted side of firewall) needs to talk to a web server on port 443 (untrusted side) Trusted rule exists on the Cisco ASA - permit Host_A Web_SVR port 443

The trusted rule should allow Host A to talk to the web server on port 443 and also allow the return traffic for that session through the firewall due to the session being initiated by the trusted source.

Everywhere I have read that the ASA is state full and return traffic rule should not be needed.

The problem is in my specific situation the ASA is denying the return traffic due to the source/destination ip's and protocols being reversed.

The question is what configurations exist in the default setup that make the Cisco ASA act in a stateful manner?

Historical Information: The stateful manner was working previously. We did an OS upgrade and received a new baseline config around the same time a few months ago. This is around when the issue started. I'm thinking it's a possible bug in the new IOS or a necessary config was overlooked or didn't take with the new IOS.

I've compared the old config and new config and there were a few object/service type syntax changes which were updated prior to loading the new config. I did not notice any failed commands when the new configs were loaded.

If you have any suggestions as to what I should try to look for I would appreciate it.

Thanks J

Answer 1

Can you post some configuration?

What you can do is perform a packet trace to see how it passes through the ASA:

ASA# packet-tracer input <trust-interface-name> tcp <src-addr> <src port> <dst ip> https

One thing to note is that the source port probably doesn't matter, so just use 1234

This should give you a step by step rundown of the operations the packet is going through, and where it's being blocked.

Answer 2

The issue has been resolved.

Problem was we upgraded the ASA OS version and the upgrade required a memory upgrade as well and memory usage was pegged at 100%. Memory upgrade is complete now and the stateful nature of the ASA has returned to normal.

Thanks for everyone's support.

Answer 3

Could be bilateral routing on the ASA. If you have redundant paths between the source/destination over the ASA via multiple interfaces, and the packet leaves via one interface, and the response comes back on a different interface, then it's not in the state table and the ASA will drop it. I've had this quite a lot due to a out of band management network causing complexities around routing, we ended up having to fix it using PBR.

The ACL's on the ASA do stateful by deafult, but it is possible to make an exception, can't remember how to do that off the top of my head, i'll have a look around and see if i can find it.