Packet Flow through an ASA Firewall - IP-NETWORK-BASICS (2024)

In this topic, I will talk about step by step flow of traffic from ingress to egress interface. To simplify the interface that receives the packet is called the ingressinterface and the interface through which the packet exits is called theegress interface. Here is a sample scenario:

When an inside user (192.168.1.5) attempts to access a web server in the demilitarized zone (DMZ) network (172.16.1.5), the packet will use the below information :

• Source address – 192.168.1.5
• Source port – 22960
• Destination address – 172.16.1.5
• Destination port – 8080
• Ingress interface – Inside
• Egress interface – DMZ
• Protocol used – TCP (Transmission Control Protocol)

A packet will go through a list of steps with the above information :

1. The packet first reached at the ingress interface of the ASA.
2. After reaching to internal buffer of the interface, the input counter of the interface is incremented by one.
3. Cisco ASAfirst looks at its internal connection table details in order to verify if this is a current connection.If the packet flow matches a current connection, then the Access Control List (ACL) check is bypassed and the packet is moved forward.If packet flow does not match a current connection, then the TCP state is verified. If it is a SYN packet or UDP (User Datagram Protocol) packet, then the connection counter is incremented by one and the packet is sent for an ACL check. If it is not a SYN packet, the packet is dropped and the event is logged.
4. If the packet cross-step 3, it is then processed as per the interface ACLs. It is verified in the sequential order of the ACL entries and if it matches any of the ACL entries, it moves forward. Otherwise, the packet is dropped and the information is logged. The ACL hit count is incremented by one when the packet matches the ACL entry.
5. In the next step the packet is verified for the translation rules. If a packet passes through this check, then a connection entry is created for this flow and the packet moves forward. Otherwise, the packet is dropped and the information is logged.
6. The packet is subjected to an Inspection Check. This inspection verifies whether or not this specific packet flow is in compliance with the protocol. Cisco ASA has a built-in inspection engine that inspects each connection as per its pre-defined set of application-level functionality. If it passed the inspection, it is moved forward. Otherwise, the packet is dropped and the information is logged.Additional security checks will be implemented if a Content Security (CSC) module is involved.
7. The IP header information is translated as per the Network Address Translation/ Port Address Translation (NAT/PAT) rule and checksums are updated accordingly. The packet is forwarded to Advanced Inspection and Prevention Security Services Module (AIP-SSM) for IPS related security checks when the AIP module is involved.
8. The packet is forwarded to the egress interface based on the translation rules. If no egress interface is specified in the translation rule, then the destination interface is decided based on the global route lookup.
9. On the egress interface, the interface route lookup is performed. Remember, the egress interface is determined by the translation rule that takes priority.
10. Once a Layer 3 route has been found and the next hop identified, Layer 2 resolution is performed. The Layer 2 rewrite of the MAC header happens at this stage.
11. The packet is transmitted on the wire, and interface counters increment on the egress interface.

Few show commands to verify the output in each step:

show interface
show conn
show access-list
show xlate
show service-policy inspect
show run static
show run nat
show run global
show nat
show route
show arp

Related