dan_track wrote:
Hi,
I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:
interface GigabitEthernet0/1.242
description Site2
vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248
access-list site2-acl extended permit icmp any any
and then I apply it with :
access-group site2-acl in interface dmz-site2
And I setup nat:
nat (inside) 2 access-list site2-nat
global (dmz-site2) 2 interface
As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?
Can someone please explain the process to me.
Thanks
Dan
Dan
Your acl will block any connections initiated from dmz-site2 to anywhere except for ICMP. However it will not block return traffic because that is what a stateful firewall is all about. So if you initiate a connection from inside and that traffic is allowed onto the dmz-site2 then the return traffic will not be checked against the site2-acl.
It's the same for traffic initiated from the outside. If it is allowed onto dmz-site2 then the return traffic will be allowed back out ie. site2-acl will not be checked.
The above applies to protocols that a stateful firewall can keep state for. TCP/UDP have always been that way. ICMP inspection was added in version 7.x so it applies to ICMP as well now as long as you enable ICMP inspection on the firewall.
There are other protocols however such as GRE which are not stateful and if they are not stateful then the return traffic would be checked against the site2-acl.
Having said that, the vast majority of apps going through a firewall are TCP/UDP so what i have outlined above applies to most traffic.
Jon
