Solved: Order of operations

m.surtees · ‎04-26-2009

Can anyone point to a list of traffic flow order or order of operations doco for the ASA 7.2.x

I only seem to be able to find one that relates to IOS CBAC.

I'm trying to answer a client's question (reference needed): Will Inbound encrypted communications be unencrypted and inspected before entering the internal network?

Having the rest of the flow would be useful for reference.

Many thanks,

Mike

mdombek_biz · ‎04-27-2009

I know I've seen the OoP of the ASA some days a go.

Please have a look at Joe Harris 6200networks.com post about OoP:

http://6200networks.com/2008/09/05/asa-order-of-operation/

cheers Michael

View solution in original post

Jon Marshall · ‎04-27-2009

Mike

In addition to the link posted in the other thread -

"Will Inbound encrypted communications be unencrypted and inspected before entering the internal network?"

It depends on the setting of the "sysopt connection permit-vpn" If it is enabled then after the traffic is unencrypted it bypasses interface acl's. If it is disabled then unencrypted traffic is then checked against the interface acl, see this link for full details -

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s8_72.html#wp1198155

Jon

View solution in original post

mdombek_biz · ‎04-27-2009

I know I've seen the OoP of the ASA some days a go.

Please have a look at Joe Harris 6200networks.com post about OoP:

http://6200networks.com/2008/09/05/asa-order-of-operation/

cheers Michael

m.surtees · ‎04-27-2009

Thanks Michael,

That will prove very useful for the document. I tried a packet trace to answer my question before I originally posted but I don't have a lab device so could not easily get a flow that included all crypto, NAT, ACLs, and so on on the prod device.

Thanks again

Mike

p.s. I'll come back to rate you

Jon Marshall · ‎04-27-2009

Mike

In addition to the link posted in the other thread -

"Will Inbound encrypted communications be unencrypted and inspected before entering the internal network?"

It depends on the setting of the "sysopt connection permit-vpn" If it is enabled then after the traffic is unencrypted it bypasses interface acl's. If it is disabled then unencrypted traffic is then checked against the interface acl, see this link for full details -

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s8_72.html#wp1198155

Jon

m.surtees · ‎04-27-2009

Thanks Jon,

It's on my FW as it's the default. Good reminder though as I'd forgotten about that cmd. It's one of those that's not in the runnning-config and needs a show run sysopt - but you knew that or you wouldn't have been able to help me

Although my clients question could be ambiguous I'm going to take him literally: does it inspect as in application inspection after decrypt?

Unfortunately even the other post from Michael doesn't spell this out, not to me anyway.

Thanks again

Mike