How does NAT, Stateful connection and access-list fit together?

Answered Question
Mar 18th, 2010
User Badges:

Hi,


I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:


interface GigabitEthernet0/1.242
description Site2

vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248


access-list site2-acl extended permit icmp any any


and then I apply it with :


access-group site2-acl in interface dmz-site2


And I setup nat:


nat (inside) 2 access-list site2-nat
global (dmz-site2) 2  interface


As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?


Can someone please explain the process to me.


Thanks

Dan

Correct Answer by Jon Marshall about 7 years 3 months ago

dan_track wrote:


Hi,


I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:


interface GigabitEthernet0/1.242
description Site2

vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248


access-list site2-acl extended permit icmp any any


and then I apply it with :


access-group site2-acl in interface dmz-site2


And I setup nat:


nat (inside) 2 access-list site2-nat
global (dmz-site2) 2  interface


As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?


Can someone please explain the process to me.


Thanks

Dan


Dan


Your acl will block any connections initiated from dmz-site2 to anywhere except for ICMP. However it will not block return traffic because that is what a stateful firewall is all about. So if you initiate a connection from inside and that traffic is allowed onto the dmz-site2 then the return traffic will not be checked against the site2-acl.


It's the same for traffic initiated from the outside. If it is allowed onto dmz-site2 then the return traffic will be allowed back out ie. site2-acl will not be checked.


The above applies to protocols that a stateful firewall can keep state for. TCP/UDP have always been that way. ICMP inspection was added in version 7.x so it applies to ICMP as well now as long as you enable ICMP inspection on the firewall.


There are other protocols however such as GRE which are not stateful and if they are not stateful then the return traffic would be checked against the site2-acl.


Having said that, the vast majority of apps going through a firewall are TCP/UDP so what i have outlined above applies to most traffic.


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Thu, 03/18/2010 - 07:05
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

dan_track wrote:


Hi,


I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:


interface GigabitEthernet0/1.242
description Site2

vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248


access-list site2-acl extended permit icmp any any


and then I apply it with :


access-group site2-acl in interface dmz-site2


And I setup nat:


nat (inside) 2 access-list site2-nat
global (dmz-site2) 2  interface


As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?


Can someone please explain the process to me.


Thanks

Dan


Dan


Your acl will block any connections initiated from dmz-site2 to anywhere except for ICMP. However it will not block return traffic because that is what a stateful firewall is all about. So if you initiate a connection from inside and that traffic is allowed onto the dmz-site2 then the return traffic will not be checked against the site2-acl.


It's the same for traffic initiated from the outside. If it is allowed onto dmz-site2 then the return traffic will be allowed back out ie. site2-acl will not be checked.


The above applies to protocols that a stateful firewall can keep state for. TCP/UDP have always been that way. ICMP inspection was added in version 7.x so it applies to ICMP as well now as long as you enable ICMP inspection on the firewall.


There are other protocols however such as GRE which are not stateful and if they are not stateful then the return traffic would be checked against the site2-acl.


Having said that, the vast majority of apps going through a firewall are TCP/UDP so what i have outlined above applies to most traffic.


Jon

dan_track Thu, 03/18/2010 - 07:24
User Badges:

Thanks Jon,


Great insight. Much appreciated.


Dan

Actions

This Discussion