ASA Traffic Behavior

[fatalXerror]

Hi Experts,

Good Day!

I would like to ask about the behavior of the ASA in terms of traffic going in and out. Does ASA change the source port of the traffic when getting out of it by default?

Thank you.

[Karsten Iwen · Accepted solution]

No ports or addresses are changed as there is not any NAT/PAT by default. If you enable PAT, the ASA tries to keep the original port but changes the port if the port is already in use by the ASA.

Here is an example of doing PAT on an ASA:

TCP PAT from any:10.10.64.53/55912 to outside:192.0.2.10/55912 flags ri idle 0:00:34 timeout 0:00:30
TCP PAT from any:10.10.64.32/52191 to outside:192.0.2.10/52191 flags ri idle 0:00:49 timeout 0:00:30
TCP PAT from any:10.10.64.103/62467 to outside:192.0.2.10/62467 flags ri idle 0:00:52 timeout 0:00:30

As you see, the source-port stays the same.

[Edwin Matos · Accepted solution]

Nikko,

I test this using PAT, as stated before if the port is no in used it will keep the source port, but if it is in use it will be change to a random number.

I Open Cisco.com and run a net stat:

C:\Users\Edwin>netstat -na | find /n "72.163.4.161"
[73]  TCP    192.168.28.82:9718     72.163.4.161:80        ESTABLISHED

Then show look for the port or source IP into the ASA xlate

Mat-Core-ASA# show xlate  | i 9718
TCP PAT from inside:192.168.28.82/9718 to outside:216.58.216.110/9718 flags ri idle

As you can see ASA accepted and kept the tcp 9718 as same source of the desktop, but again if the port was used it will change it.