Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ASA/PIX traffic order

Try to understand ASA/PIX traffic order.

For example, inbound traffic (non management traffic) will go through flow check,  inbound access-list, nat , filter, outbound access-list, etc.

And if it's returned traffic and session is existed, what the firewall will do next?  Simply bypass access-list but still apply NAT?  Anything else the firewall will do?

Please share your thought.  Thanks.

1 REPLY
Cisco Employee

Re: ASA/PIX traffic order

For any inbound traffic (all packets) , i.e. from LOWER security-level to HIGHER security-level here is the order of operation on Cisco firewalls :

  1. Access-list check
  2. Any policing/shaping applied for QOS.
  3. NAT
  4. Route table lookup

For any outbound traffic  (all packets)  , i.e. from HIGHER security-level to LOWER  security-level here is the order of operation on Cisco firewalls :

  1. Access-list check
  2. Any policing/shaping applied for QOS
  3. Route table lookup
  4. NAT

Here is  order of preference for NAT :

1.NAT0

2.Policy static NAT

3.Policy NAT

4. Static PAT

5. Static NAT

6.Dynamic NAT

In answer to your 2nd question : what will ASA do if session is already existing , will it bypass ACL check or NAT etc..

We need to remember that Cisco ASA (Adaptive Security Appliance) remembers the state of connection until it is finished by parties involved. Also, a NAT translation built by ASA does not timeout until 3 hours (default xlate timeout timer) for a specific flow. Moreover NAT xlate is built PER FLOW and NOT per packet by firewall. After doing all initial checks once, the session is setup & firewall (being adaptive) will not do any more checks for return traffic, because it remembers the connection.

Here is a useful link for you :-

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml

Feel free to let me know if you have any more questions.

HTH

Vijaya

969
Views
0
Helpful
1
Replies
CreatePlease to create content