topic Protocols allowed to pass ASA in Network Security

Protocols allowed to pass ASA

mahesh18 — Tue, 12 Mar 2019 00:13:37 GMT

Hi Everyone,

Need to know how can we tell from sh run config that what protocols are allowed means ASA is not doing any inspection

on them or we can say it is not blocking - when traffic passes through the ASA?

Also is there any command which we can use from CLI to check this?

Thanks

Mahesh

Protocols allowed to pass ASA

Julio Carvajal — Wed, 24 Oct 2012 20:57:18 GMT

Hello Mahesh,

You have different options

Run a packet-tracer will definelty let you know all the traffic rules that a particular flow takes.

packet-tracer input interface_name_if tcp/udp source_ip source_port destination_ip destination_port

Or just by checking inspection policies, ACL's, Nat rules.

Protocols allowed to pass ASA

mahesh18 — Wed, 24 Oct 2012 21:19:21 GMT

Hi Julio,

If sh run shows following configuration

case1

policy-map global_policy

class inspection_default

inspect icmp ***************************************

service-policy global_policy global

Does inspect icmp here means that allow icmp if ping is sourced from inside of the network?

Need to know the exact purpose of inspect command in ASA config???

policy-map global_policy --- does it mean that it applies to whole ASA traffic ?

******************************************************************************************************************

service-policy global_policy global ----Purpose of this command?

Thanks

Mahesh

Protocols allowed to pass ASA

Julio Carvajal — Wed, 24 Oct 2012 21:39:21 GMT

Hello,

That means that if ICMP connection is allowed on 'X" interface the returning traffic will be allowed because of the inspection ( session will be on the connection table of the ASA)

policy-map global_policy --- does it mean that it applies to whole ASA traffic ?

No, that is just the name of the policy.

The command that defines where to set this up is the service-policy and ofcourse a global means all over the interfaces.

Regards,

Protocols allowed to pass ASA

mahesh18 — Thu, 25 Oct 2012 02:12:31 GMT

Hi Julio,

Many Thanks again

Regards

Mahesh