2. Once the packet reaches the internal buffer of the interface, the input counter of the interface is incremented by one.
Cisco ASA will first verify if this is an existing connection by
looking at its internal connection table details. If the packet flow
matches an existing connection, then the access−control list (ACL)
check is bypassed, and the packet is moved forward.
packet flow does not match an existing connection, then TCP state is
verified. If it is a SYN packet or UDP packet, then the connection
counter is incremented by one and the packet is sent for an ACL check.
If it is not a SYN packet, the packet is dropped and the event is
4. The packet
is processed as per the interface ACLs. It is verified in sequential
order of the ACL entries and if it matches any of the ACL entries, it
moves forward. Otherwise, the packet is dropped and the information is
logged. The ACL hit count will be incremented by one when the packet
matches the ACL entry.
The packet is verified for the translation rules. If a packet passes
through this check, then a connection entry is created for this flow,
and the packet moves forward. Otherwise, the packet is dropped and the
information is logged.
The packet is subjected to an Inspection Check. This inspection
verifies whether or not this specific packet flow is in compliance with
the protocol. Cisco ASA has a built−in inspection engine that inspects
each connection as per its pre−defined set of application−level
functionalities. If it passed the inspection, it is moved forward.
Otherwise, the packet is dropped and the information is logged. Additional Security−Checks will be implemented if a CSC module is involved.·
The IP header information is translated as per the NAT/PAT rule and
checksums are updated accordingly. The packet is forwarded to AIP−SSM
for IPS related security checks, when the AIP module is involved.
The packet is forwarded to the egress interface based on the
translation rules. If no egress interface is specified in the
translation rule, then the destination interface is decided based on
global route lookup.
the egress interface, the interface route lookup is performed.
Remember, the egress interface is determined by the translation rule
that will take the priority.
Once a Layer 3 route has been found and the next hop identified, Layer 2
resolution is performed. Layer 2 rewrite of MAC header happens at this
11. The packet is transmitted on wire, and Interface counters increment on the egress interface.