Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

How does NAT, Stateful connection and access-list fit together?

Hi,

I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:

interface GigabitEthernet0/1.242
description Site2

vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248

access-list site2-acl extended permit icmp any any

and then I apply it with :

access-group site2-acl in interface dmz-site2

And I setup nat:

nat (inside) 2 access-list site2-nat
global (dmz-site2) 2  interface

As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?

Can someone please explain the process to me.

Thanks

Dan

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: How does NAT, Stateful connection and access-list fit togeth

dan_track wrote:

Hi,

I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:

interface GigabitEthernet0/1.242
description Site2

vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248

access-list site2-acl extended permit icmp any any

and then I apply it with :

access-group site2-acl in interface dmz-site2

And I setup nat:

nat (inside) 2 access-list site2-nat
global (dmz-site2) 2  interface

As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?

Can someone please explain the process to me.

Thanks

Dan

Dan

Your acl will block any connections initiated from dmz-site2 to anywhere except for ICMP. However it will not block return traffic because that is what a stateful firewall is all about. So if you initiate a connection from inside and that traffic is allowed onto the dmz-site2 then the return traffic will not be checked against the site2-acl.

It's the same for traffic initiated from the outside. If it is allowed onto dmz-site2 then the return traffic will be allowed back out ie. site2-acl will not be checked.

The above applies to protocols that a stateful firewall can keep state for. TCP/UDP have always been that way. ICMP inspection was added in version 7.x so it applies to ICMP as well now as long as you enable ICMP inspection on the firewall.

There are other protocols however such as GRE which are not stateful and if they are not stateful then the return traffic would be checked against the site2-acl.

Having said that, the vast majority of apps going through a firewall are TCP/UDP so what i have outlined above applies to most traffic.

Jon

2 REPLIES
Hall of Fame Super Blue

Re: How does NAT, Stateful connection and access-list fit togeth

dan_track wrote:

Hi,

I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:

interface GigabitEthernet0/1.242
description Site2

vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248

access-list site2-acl extended permit icmp any any

and then I apply it with :

access-group site2-acl in interface dmz-site2

And I setup nat:

nat (inside) 2 access-list site2-nat
global (dmz-site2) 2  interface

As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?

Can someone please explain the process to me.

Thanks

Dan

Dan

Your acl will block any connections initiated from dmz-site2 to anywhere except for ICMP. However it will not block return traffic because that is what a stateful firewall is all about. So if you initiate a connection from inside and that traffic is allowed onto the dmz-site2 then the return traffic will not be checked against the site2-acl.

It's the same for traffic initiated from the outside. If it is allowed onto dmz-site2 then the return traffic will be allowed back out ie. site2-acl will not be checked.

The above applies to protocols that a stateful firewall can keep state for. TCP/UDP have always been that way. ICMP inspection was added in version 7.x so it applies to ICMP as well now as long as you enable ICMP inspection on the firewall.

There are other protocols however such as GRE which are not stateful and if they are not stateful then the return traffic would be checked against the site2-acl.

Having said that, the vast majority of apps going through a firewall are TCP/UDP so what i have outlined above applies to most traffic.

Jon

New Member

Re: How does NAT, Stateful connection and access-list fit togeth

Thanks Jon,

Great insight. Much appreciated.

Dan

497
Views
0
Helpful
2
Replies
CreatePlease to create content