Will conduit take precedence over statefull inspection?

jsluzewski · ‎11-03-2003

Will the conduit statement:

conduit permit ip host host_ip any

allow out-of-session packets (for which firewall does not have entry in its connection table) arriving due to asymetric routing?

rais · ‎11-04-2003

Yes, all IP packets will be allowed.

HTH.

scoclayton · ‎11-04-2003

No, this is not correct. The conduit statement specified will allow SYN packets sourced from anywhere into this host but once the conn is created, the PIX will check Sequence #, ACK #, flags, etc. via the ASA to determine if the packets are allowed to pass. If the packets do not match a current conn, the PIX will silently drop the packet.

Scott

rais · ‎11-04-2003

Scott,

Thanks for the correction and clarification.

Rais.