topic ASA capture with SFR in Network Security

ASA capture with SFR

markus.albisser1 — Mon, 21 Dec 2020 13:27:44 GMT

Dear all

I have a short question to you guys, when I run a capture on the outside (Internet) interface of an ASA-5545 (the ASA has the SFR module installed and acts as a NGFW) with the following command:

capture capin interface outside match ip host 100.100.100.100 any

And then checking this capture with the command:

show capture capin dump

Are the details I see now how this data really enters the interface? Without any applied Service Policy Rules, without any applied ACLs and before the Firepower module would take any actions? Means when I see a certain flag in the dump within the protocol, I can assume this flag has been sent by the source IP address and has not been changed by my ASA firewall within a policy?

Of course you have a good article which describes this behavior, where the capture applies to?

Thank you

Markus

Re: ASA capture with SFR

balaji.bandi — Mon, 21 Dec 2020 15:00:16 GMT

check below blog will give you some idea what interface using to capture :

https://popravak.wordpress.com/2017/03/17/packet-capture-with-sourcefire-cli/

Re: ASA capture with SFR

markus.albisser1 — Mon, 21 Dec 2020 15:40:56 GMT

Hi Balaji

Thank you for this link. Helpful troubleshooting steps when logging on the SFR module! This is what I can do, check the logging there and compare it with the capture from the ASA.

Nevermind, do you know if the ASA capture is really on the ingress of the interface, therefore before the SFR module comes in charge? That the ASA capture gets the raw-data before anything within the ASA has been handled?

Thanks

Markus

Re: ASA capture with SFR

balaji.bandi — Mon, 21 Dec 2020 16:13:56 GMT

you need to understand the traffic flow how this process works, and where you capturing.

https://www.ciscopress.com/articles/article.asp?p=2730336&seqNum=7

Re: ASA capture with SFR

Marvin Rhoads — Tue, 22 Dec 2020 03:52:55 GMT

An ASA capture on an interfaces does indeed show you the raw traffic entering the interface, prior to any action potentially taken by the ASA to evaluate the flow or disposition of the packet(s).

Re: ASA capture with SFR

markus.albisser1 — Tue, 22 Dec 2020 05:11:19 GMT

Great diagram, thanks Balaji for this post. This is what I looked for. Together with Marvin's answer below, this answers my question.

Thank you

Markus