ASA Deep packet inspection

[vitumbiko nkhwazi]

Hello.

Does the Cisco ASA 5516 Firewall do deep packet inspection? if it does, is it enabled by default?

Regards.

[Milos_Jovanovic]

Hi @vitumbiko nkhwazi,

Firstly, you need to diferentiate between HW and SW when talking about Cisco products.

ASA5516 is a HW model. ASA is a software running on given HW.

ASA5516 can run ASA SW, FTD SW and (although I would not recommend it anymore) ASA with Firepower services.

ASA SW is a L3/L4 firewall, capable of doing some protocol inspection, but I wouldn't call it DPI (in terms it is used today).

FTD SW and ASA with Firepower services are capable of running DPI (IPS, URL filtering, anti-malware protection), but you need appropriate licenses.

So to answer your question, this HW model supports it, but it really depends on the SW version running on top of it.

BR,

MIlos

[vitumbiko nkhwazi]

Hello Milos.

Thanks for the clarification, from the output of the 'Show version' below, the device is running the ASA Software so i guess DPI is not supported 

Cisco Adaptive Security Appliance Software Version 9.14(2)8
SSP Operating System Version 2.8(1.144)
Device Manager Version 7.8(2)

Compiled on Fri 29-Jan-21 18:43 GMT by builders
System image file is "disk0:/asa9-14-2-8-lfbff-k8.SPA"
Config file at boot was "startup-config"

NBS-BT-DC-ASA5516-PRODUCTION up 148 days 15 hours

Hardware: ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores)
Internal ATA Compact Flash, 8000MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

1: Ext: GigabitEthernet1/1 : address is f86b.d95a.d746, irq 255
2: Ext: GigabitEthernet1/2 : address is f86b.d95a.d747, irq 255
3: Ext: GigabitEthernet1/3 : address is f86b.d95a.d748, irq 255
4: Ext: GigabitEthernet1/4 : address is f86b.d95a.d749, irq 255
5: Ext: GigabitEthernet1/5 : address is f86b.d95a.d74a, irq 255
6: Ext: GigabitEthernet1/6 : address is f86b.d95a.d74b, irq 255
7: Ext: GigabitEthernet1/7 : address is f86b.d95a.d74c, irq 255
8: Ext: GigabitEthernet1/8 : address is f86b.d95a.d74d, irq 255
9: Int: Internal-Data1/1 : address is f86b.d95a.d745, irq 255
10: Int: Internal-Data1/2 : address is 0000.0001.0002, irq 0
11: Int: Internal-Control1/1 : address is 0000.0001.0001, irq 0
12: Int: Internal-Data1/3 : address is 0000.0001.0003, irq 0
13: Ext: Management1/1 : address is f86b.d95a.d745, irq 0
14: Int: Internal-Data1/4 : address is 0000.0100.0001, irq 0

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 150 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
Carrier : Disabled perpetual
AnyConnect Premium Peers : 4 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 300 perpetual
Total VPN Peers : 300 perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Shared License : Disabled perpetual
Total TLS Proxy Sessions : 1000 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Enabled perpetual
Cluster Members : 2 perpetual
VPN Load Balancing : Enabled perpetual

[Milos_Jovanovic]

As I said, DPI (in terms used today, it assumes IPS, AVC, URL Filtering and so on) is not supported on ASA SW.

ASA does support application protocol inspection however, if that is sufficient for you. You can find more details here. By using protocol inspection, you can intrduce additional control beyond L3/L4 (e.g. for FTP protocol, you can block 'DELETE' command).

BR,

Milos