ASA unexpected bi-directional access

Unanswered Question
Apr 14th, 2009
User Badges:

Hello.

My Cisco ASA firewall is set to allow inbound HTTPS connections to a webserver, which works great.


Exemplified by the log entry below;


access-list outside_access_in permitted tcp outside/22.44.55.77(22913) -> inside/WEBSERVER(443) hit-cnt 1 first hit [0xdfea2982, 0x0]


However there is also a log entry reflecting traffic back to the client in the other direction "FROM" tcp/443.


access-list inside_access_in permitted tcp inside/WEBSERVER(443) -> outside/22.44.55.77(22913) hit-cnt 1 first hit [0xdfea2982, 0x0]


I was not expecting this entry or connection as I had planned to block all "outbound" connections from this server.


I thought the ASA would be aware of an already existing inbound connection and not need to establish outbound.


Can someone please explain this?


Thanks.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
roshan.maskey Wed, 04/15/2009 - 01:10
User Badges:

Hi,


The second access-list you have seen is for the return traffic to the originating source.


The traffic to secure webserver was initiated from outside zone with (SYN flag set). The server has to respond to the connection i.e allow the traffic through that session, server sends back (SYN/ACK) and other request-response via 443 to the source service port.


The acl you have seen is normal, it is dynamically opened by ASA and will shutdown as you terminate the session to the server.



vikram_anumukonda Wed, 04/15/2009 - 08:22
User Badges:
  • Bronze, 100 points or more

couple of questions.


1) do you have a " service-policy " configured/applied globally on the firewall .


2) do you see hits in your ACL for the return traffic.

mikedelafield Fri, 04/17/2009 - 02:08
User Badges:

Hi.

Thanks for your reply.


1) there is no service policy


2) yes there are hits for the return traffic on the outbound ACL.


I would like to remove the ACL though as it is initiated inbound so should not be required?

vikram_anumukonda Fri, 04/17/2009 - 02:39
User Badges:
  • Bronze, 100 points or more

Copy paste the below code after which you should not require an ACL for return traffic. This is supposed to be there by default . If this does not help, Pls post your configs.


!

class-map inspection_default

match default-inspection-traffic

!

policy-map global_policy

class inspection_default

inspect dns maximum-length 512

inspect ftp

inspect h323 h225

inspect h323 ras

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

!




HTH

Vikram

Actions

This Discussion