topic NAT,ACCESS RULES N TRAFFIC INSPECTION in Network Security

NAT,ACCESS RULES N TRAFFIC INSPECTION

Antonio Simoes — Tue, 12 Mar 2019 02:35:53 GMT

Hi,

Can anyone awnser this questions?

What I have to do to:
1. Allow only traffic http/https from the inside to dmz
2. Allow only traffic http/https from the dmz to inside

How can I simulate inspected retrurning traffic in packet tracer? Otherwise I never know if it will be allowed to return.

Kind regards,

NAT,ACCESS RULES N TRAFFIC INSPECTION

Julio Carvajal — Mon, 09 Sep 2013 18:40:01 GMT

Hello Antonio,

For this particular traffic (HTTP, HTTPS) there will be only one session or data channel so with a regular packet-tracer you will be able to determine whether the returning traffic will be allowed or not.

An example would be with ICMP (without the stateful inspection you will see a drop on the packet-tracer.. It points to an ACL issue I think).

What I will provide you is a really useful command that not all of the people is aware of:

show service-policy flow tcp host x.x.x.x host x.x.x.x eq 80

You will be seeing if a policy inspection or parameter is matched

For more information about Core and Security Networking follow my website at http://laguiadelnetworking.com

Any question contact me at jcarvaja@laguiadelnetworking.com

Cheers,

Julio Carvajal Segura

NAT,ACCESS RULES N TRAFFIC INSPECTION

Antonio Simoes — Mon, 09 Sep 2013 22:37:23 GMT

Hi J,

I´m confuse about one situation. In on of my branch companies, I have conected to my ASA inside port a ISR 2911/K9, doing router on the stick to my vlan´s. But now I have do conect a service on the main office. So I will do a Site-to-Site VPN on the ASA. But the local network is on of my vlans.

So what will happen, I do the VPN and the ASA Route the traffic to the ISR and vice versa?

Kind Regards,

NAT,ACCESS RULES N TRAFFIC INSPECTION

Julio Carvajal — Mon, 09 Sep 2013 22:43:01 GMT

Hello Antonio,

Exactly, You build the VPN between the ASA and the other site and the ASA routes and encrypts the traffic properly

NAT,ACCESS RULES N TRAFFIC INSPECTION

Antonio Simoes — Mon, 09 Sep 2013 22:49:42 GMT

Hi J

Ok. Two days from now I will test it.

Take care man.

NAT,ACCESS RULES N TRAFFIC INSPECTION

Julio Carvajal — Mon, 09 Sep 2013 22:52:12 GMT

Hello Antonio,

Sure, keep me posted!

NAT,ACCESS RULES N TRAFFIC INSPECTION

Antonio Simoes — Mon, 09 Sep 2013 22:56:56 GMT

Sure