topic Question about SFR device bypass in Network Security

Question about SFR device bypass

LuigiDiFronzo9542 — Tue, 29 Dec 2020 19:16:42 GMT

Hello,

I have an ASA 5545 with Firepower services, In the ASA we have the Service Policy Rule as show:

From Lan Network to Management Network and viceversa then bypass,

From any to any then send to the SFR device.

In this case all the trafic that doesn't match the rule is sent to the module for apply internet acces control rules among others.

My question is:

When will be applied the Access control Rules created in the ASA? before or after the traffic goes to the SFR? or won't be applied?

For example: Suppose that the ASA allows the access Https from the Outside Network to Server A, but not to server B.

What If I have a rule in the SFR where Https traffic is allowed from the Outside to the server A and B?

Will traffic to the server B allowed?

Thank you.

Luigi.

Re: Question about SFR device bypass

Marius Gunnerud — Tue, 29 Dec 2020 20:47:28 GMT

The ASA access-list will be checked first, then SFR, and then ASA again on the way out. Same principle applies to the FTD.

Re: Question about SFR device bypass

LuigiDiFronzo9542 — Wed, 30 Dec 2020 18:43:18 GMT

Thank you Marius,

So in the example above, do you mean that traffic from outside to server B should not be allowed?

Another example: Imagine that the ASA allows only traffic from server AA in DMZ to the outside, any other access is denied; and the SFR allows traffic from the pool of DMZ servers (including server AA and server BB) to the outside. In this especific case,
will the traffic from server BB to the outside be banned?

Thank you

Re: Question about SFR device bypass

Marius Gunnerud — Fri, 01 Jan 2021 21:46:46 GMT

So in the example above, do you mean that traffic from outside to server B should not be allowed?

That is correct.

Imagine that the ASA allows only traffic from server AA in DMZ to the outside, any other access is denied; and the SFR allows traffic from the pool of DMZ servers (including server AA and server BB) to the outside. In this especific case,
will the traffic from server BB to the outside be banned?

BB will not be allowed if the ASA ingress interface access-list does not allow the traffic. Again, the access-list on the ingress interface will be checked first, then SFR, followed by the ASA egress interface access-list

Re: Question about SFR device bypass

LuigiDiFronzo9542 — Mon, 04 Jan 2021 22:08:29 GMT

Thank you Marius