topic ASA and statefull filtering in Network Security

ASA and statefull filtering

mahesh18 — Tue, 12 Mar 2019 01:36:06 GMT

Hi everyone,

I read that ASA by default do statefull filtering for TCP and UDP packets.

If user access internet website then return traffic is allowed from the internet.

Curious to know what config in ASA allows statefull filtering ?

Or does ASA support statefull filtering in hardware?

Thanks

MAhesh

ASA and statefull filtering

cadet alain — Sun, 28 Apr 2013 18:02:32 GMT

Hi,

You've got nothing special to configure: traffic from ahigh security level inteface can pass through the ASA and return traffic is permitted based on the state table that the ASA built. By default this is only for TCP and UDP but if you inspect ICMP then it will also work for ICMP.

Regards

Alain

Don't forget to rate helpful posts.

ASA and statefull filtering

Jouni Forss — Sun, 28 Apr 2013 18:04:58 GMT

Hi Mahesh,

ASA does this by default without any certain configuration on it.

It for example allows return traffic for already formed flows/connections through it. On the other hand ofcourse if the ASA sees traffic that seems to be part of some connection but the ASA doesnt have an existing flow for it, it denies the traffic. A stateless device/firewall would have simply allowed the same connection through.

When you add ASAs Inspections to this you will get more control of certain applications.

For example "inspect ftp" enables the ASA to handle the secondary Data connection that is formed after the original Control connection is formed. Then theres for example "inspect dns" which control the DNS messages through the ASA firewall. Then theres for example ICMP inspection which allows the replies to ICMP Echo messages sent by the host behind ASA automatically.

- Jouni

ASA and statefull filtering

mahesh18 — Sun, 28 Apr 2013 18:19:12 GMT

Hi Alain & Jouni,

Thanks again for clearing my concepts.

Best regards

MAhesh