topic FMC: Does packet state impact Access Control Policy processing? in Network Security

FMC: Does packet state impact Access Control Policy processing?

00u1arh1c7Nbc5p2z5d7 — Wed, 21 Jul 2021 16:32:08 GMT

For our first rule in our Access Control Policy, we've got a geolocation block on incoming traffic from country X. There is no corresponding rule for outgoiong traffic to country X, however.

So, as I understand it, anyone in country X trying to initiate a new connection to us would have the packet dropped. However, someone trying to initiate a connection to country X from inside our network would be allowed through the firewall.

What I'm not clear on is, in the latter case, would the response packet from country X, which would hit the firewall with state "ESTABLISHED" rather than "NEW," still get blocked by the geolocation rule?

Re: FMC: Does packet state impact Access Control Policy processing?

balaji.bandi — Wed, 21 Jul 2021 16:49:53 GMT

Since FW is statefull if the connection intiated from inside and allowed, the that should be ok.

if the intiation from outside should be blocked, your understanding correct ?

Do you see any issue, or is that just clarfication ?

Re: FMC: Does packet state impact Access Control Policy processing?

00u1arh1c7Nbc5p2z5d7 — Wed, 21 Jul 2021 17:54:32 GMT

Thanks, Balaji. I was just looking for clarification.