topic Re: How does NAT, Stateful connection and access-list fit togeth in Network Security

How does NAT, Stateful connection and access-list fit together?

dan_track — Mon, 11 Mar 2019 17:23:08 GMT

Hi,

I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:

interface GigabitEthernet0/1.242
description Site2

vlan 242
nameif dmz-site2
security-level 58
ip address 10.4.9.1 255.255.255.248

access-list site2-acl extended permit icmp any any

and then I apply it with :

access-group site2-acl in interface dmz-site2

And I setup nat:

nat (inside) 2 access-list site2-nat
global (dmz-site2) 2 interface

As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?

Can someone please explain the process to me.

Thanks

Dan

Re: How does NAT, Stateful connection and access-list fit togeth

Jon Marshall — Thu, 18 Mar 2010 14:05:53 GMT

dan_track wrote:
Hi,
I'm confused basically I've got an interface on my asa firewall that I need to ensure is locked down via an access-list. My acl will look like this:
interface GigabitEthernet0/1.242
 description Site2
vlan 242
 nameif dmz-site2
 security-level 58
 ip address 10.4.9.1 255.255.255.248
access-list site2-acl extended permit icmp any any
and then I apply it with :
access-group site2-acl in interface dmz-site2
And I setup nat:
nat (inside) 2 access-list site2-nat
global (dmz-site2) 2  interface
As you can see from the above only icmp will be allowed in, any other connections will be dropped. However let's say I initiate a connection to site 2 from inside what will happen to the return traffic from site2? As I currently see it the acl "site2-acl" will block traffic from site2 as it doesn't allow any traffic in?
Can someone please explain the process to me.
Thanks
Dan

Dan

Your acl will block any connections initiated from dmz-site2 to anywhere except for ICMP. However it will not block return traffic because that is what a stateful firewall is all about. So if you initiate a connection from inside and that traffic is allowed onto the dmz-site2 then the return traffic will not be checked against the site2-acl.

It's the same for traffic initiated from the outside. If it is allowed onto dmz-site2 then the return traffic will be allowed back out ie. site2-acl will not be checked.

The above applies to protocols that a stateful firewall can keep state for. TCP/UDP have always been that way. ICMP inspection was added in version 7.x so it applies to ICMP as well now as long as you enable ICMP inspection on the firewall.

There are other protocols however such as GRE which are not stateful and if they are not stateful then the return traffic would be checked against the site2-acl.

Having said that, the vast majority of apps going through a firewall are TCP/UDP so what i have outlined above applies to most traffic.

Jon

Re: How does NAT, Stateful connection and access-list fit togeth

dan_track — Thu, 18 Mar 2010 14:24:20 GMT

Thanks Jon,

Great insight. Much appreciated.

Dan