cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


1027
Views
20
Helpful
6
Replies
CaB Beginner
Beginner

How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

 Hi,

how do I enable the support for TFO (RFC 7413) in Cisco Adaptive Security Appliance Software Version 9.2 ?

It seems not to work out of the box, i.e. normal connection establishment  (handshake without application data bytes) works well while TFO (syn,syn-ack with application data bytes) connection establishment is rejected.

 

Regards,

 CaB

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Re: How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

Hi

 

ASA can do TCP normalization :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#69801

 

You can modify it with TCP map :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#53790

 

but as far as I see, per default, SYN with data is supported but not SYN/ACK with data:

synack-data { allow | drop }

Sets the action for TCP SYNACK packets that contain data.

The allow keyword allows TCP SYNACK packets that contain data.

(Default) The drop keyword drops TCP SYNACK packets that contain data.

syn-data { allow | drop }

Sets the action for SYN packets with data.

(Default) The allow keyword allows SYN packets with data.

The drop keyword drops SYN packets with data.

 

Regards

 

 

 

 

6 REPLIES 6
Frequent Contributor

Re: How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

Hi, I don't see this RFC supported by ASA 

https://www.cisco.com/c/en/us/td/docs/security/asa/roadmap/asa_new_features.html

 

As workaround/test I think you could try with TCP state bypass.

 

Regards.-

 

 

 

 

 

.
Highlighted

Re: How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

Hi

 

ASA can do TCP normalization :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#69801

 

You can modify it with TCP map :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#53790

 

but as far as I see, per default, SYN with data is supported but not SYN/ACK with data:

synack-data { allow | drop }

Sets the action for TCP SYNACK packets that contain data.

The allow keyword allows TCP SYNACK packets that contain data.

(Default) The drop keyword drops TCP SYNACK packets that contain data.

syn-data { allow | drop }

Sets the action for SYN packets with data.

(Default) The allow keyword allows SYN packets with data.

The drop keyword drops SYN packets with data.

 

Regards

 

 

 

 

CaB Beginner
Beginner

Re: How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

Hi Jerome,

 

that was a very helpfull hint. I have started to modify the tcp normalization by allowing data in syn-acks.

syn-ack allow

As this did not fix the problem I configured the tcp map to be most liberal, i.e.:

tcp-map tcp-map-test
  synack-data allow
  invalid-ack allow
  tcp-options range 6 7 allow
  tcp-options range 9 255 allow
  urgent-flag allow

 

Next week I will try to figure out which of the options are necessary in order to allow TFO.

Regards,

 CaB

VIP Advocate

Re: How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

@CaB

Did you ever get this to work, or is it maybe anyway supported now?

CaB Beginner
Beginner

Re: How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

Hi patoberli,

 

yes, I got it to work. Here are the code snippets:

 

tcp-map tcp-map-fastopen
  synack-data allow
  tcp-options range 6 7 allow
  tcp-options range 9 255 allow

 

You will need a class map to match the tcp stream:

 

class-map TCP
 match port tcp range 1 65535

 

And you have to apply it in the policy section:

 

policy-map global_policy
class inspection_default
inspect ftp
...
inspect dns dns-map-60
class TCP
set connection random-sequence-number disable
set connection advanced-options tcp-map-fastopen

 

So the example above will apply the support for tcp fastopen to all tcp connections as the class map (TCP) matches any tcp port.

 

Regards,

CaB

VIP Advocate

Re: How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

Thanks a lot for your detailed answer!