topic Thank you both for the in Network Security

Cisco ASA functionality

onslaught99 — Tue, 12 Mar 2019 07:07:23 GMT

Hello,

This may be a dumb question but I am trying to prove to our customer that our ASA 5525-X does not pass traffic when there is a hardware problem or if the firewall were to power off due to some catastrophic event. I planned on just powering down the ASA but they would prefer that I don't power down the firewall to prove that data does not pass traffic. I tried looking at any documentation but I can't seem to find where its documented that the ASA will not forward traffic while it is powered down or a hardware failure. Is there any documentation that points out that the ASA will not forward traffic if powered down?

Thanks

Hi onslaught99,

rvarelac — Fri, 08 Jan 2016 04:38:42 GMT

Hi onslaught99,

I don't think it would be any documentation about this symptom. Is expected that if any network device is powered down or have a hardware failure on one of his ports won't be able to forward any inbound or outbound traffic.

Hope it helps

-Randy-

There's no documentation of

Marvin Rhoads — Fri, 08 Jan 2016 15:16:06 GMT

There's no documentation of that behavior that I have ever seen.

It's hard to prove a negative. Demonstration will show that's how it works though.

Devices that have this feature call it something like a "bypass mode interface". An example would be the high end IPS appliances like the 3D7125 and such. These "fail open" so that you don't lose connectivity in the event of a system outage.

Thank you both for the

onslaught99 — Sun, 10 Jan 2016 17:46:02 GMT

Thank you both for the feedback. As expected I didn't believe that there was any documentation about this, just that it would be common knowledge that only certain devices would a "fail bypass" function because they are not truly needed for security boundary control. I know that certain IPS/IDS devices and the WAAS devices are able to perform the fail bypass function but the firewalls are needed to control and inspect traffic coming in.

Thanks again!!

Re: Cisco ASA functionality

ipsthoughtexchange — Tue, 06 Mar 2018 08:14:53 GMT

Hi,

This is not a dumb question, you have my sympathy for having to deal with a dumb person regarding this.

I'd explain it to that person as follows: If your light bulb expires, do still have light? - Hence, if an fw is powered down or an Interface is down there will as much traffic as light goes through a defective bulb.