topic Re: Can PIX/ASA disable stateful check? in Network Security

Can PIX/ASA disable stateful check?

hetao1601 — Fri, 21 Feb 2020 11:15:20 GMT

Hi, all

I have one ASA 5510 with software 7.0, configurated as transparent firewall. Now I want to disable its stateful check, Anyone can tell me whether it support this feature? If its a routed firewall,can it support, And what is the command?

Very Thanks

Tao

Re: Can PIX/ASA disable stateful check?

Ivan Martinon — Tue, 03 Feb 2009 02:07:35 GMT

The only way to disable the STATE check on the ASA (bypass the 3 way handshake for example) is to use the static nat command with the "nailed" option as well as the failover timeout

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s8.html#wp1414075

Re: Can PIX/ASA disable stateful check?

hetao1601 — Tue, 03 Feb 2009 07:51:31 GMT

imartino

Very thanks for your reply.

1. From the explanation, it said nailed is used with 'failover timeout' command. What is that mean? I just want to disable the state check, so that asymmetric route traffic can pass through the pix. Can it support that?

BTW, I'd like to know whether it can be used on the transparent mode since it doesn't have the 'static' command.

2. It seem the following command is related with tcp state check.

invalid-ack {allow | drop}

Am I right?

Any reply is very appreciated!

Tao

Re: Can PIX/ASA disable stateful check?

Ivan Martinon — Tue, 03 Feb 2009 15:10:39 GMT

Regardless of transparent firewall statics are supported, and the failover timeout is a requirement when enabling "nailed" option. please take a look at the command reference:

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s8.html#wp1414075