ASA Traffic Flows

[andrewburridge]

Hey all, hopefully this should be a nice easy one!

I remember being told a while back that ASA devices don't handle traffic very well that goes outbound out of an interface, and then comes back inbound on the same interface.  For example:

- traffic leaves an internal LAN bound for it internet

- hits the ASA on an internal interface

- leaves the ASA external interface on a PAT address (public IP)

- hits same ASA external interface on a public IP that NATs through to an internal LAN address

- NATs through to internal LAN

Could anyone confirm that this is the case and if this behaviour has a particular name?  Like I say, I remember being told that this wouldn't work (I couldn't VPN to our external address from inside our network for example), but I'd like to read up a bit more about it.

Thanks!

[varrao]

Hi Andrew,

The flow below is correct as you have stated, but I am not really sure about your question?? Are you doubtful taht the firewall woudl drop the return traffic, because tahts not the case. Firewall is a ststeful device, which means it maintains the state table of the connections and carries out inspection and knows that the return packet is a part of the connection already established.

Let me know what you exact query is.

Thanks,

Varun

[andrewburridge]

Hi Varun,

Thanks for your reply. I guess the key to my question is I've always thought that such a traffic flow wouldn't actually work.  It doesn't work in our environment at least, and I was always told that this was just due to the inherent nature by which the ASA handles traffic.

Thanks.

[varrao]

Hi Andrew,

If you are trying to access the internet from your internal lan, then:

Request would come to ASA inside interface

NAT statement would be checked and it would PAT to your external public ip.

The return traffic would hit external ip on ASA

ASA would see that this is the reply packet to your connection request.

It would un-nat the external ip to internal lan ip and send it to your lan machine

This is how ASA would work, so yes this would work on ASA if thats your question.

Thanks,

Varun