Bidirectional rule for ASA 5585 Access-rule

[Amafsha1]

Hello, I built a rule that allows server 1.1.1.1(source) access to server 2.2.2.2(destination) on port 8400 and I tested the rule to make sure it works.  I understand that firewalls are statefull and should agree on both directions, but lets say that this time server 2.2.2.2 needs to access server 1.1.1.1 on port 8400.  Would that work without an additional rule?

[Florin Barhala]

Stateful FW means you don't need the "mirror FW rule" in regard to the already "established traffic".

So if 1.1.1.1 initiates traffic towards 2.2.2.2 then the stateful FW will allow the mirror traffic, but your current rule will NOT allow traffic INITIATED by 2.2.2.2 towards 1.1.1.1

[Amafsha1]

Ok, so than I need to build an additional rule to accomplish this?

[James Leinweber · Accepted solution]

The answer is a little complicated, but basically, yes, you might need a second rule. It depends on how many access-lists you have applied to the interfaces and what the interface security levels rare. In a trivial firewall setup with ingress rules on the outside interface, and an inside interface with a higher security level, and no other access-lists, you might get the 2.2.2.2 to 1.1.1.1 direction for free. In a more complicated setup with both ingress and egress lists on both interfaces, or more interfaces, you might have to modify two or more lists to allow the traffic. It depends on things like whether the lists have a default allow (permit any any) or default deny (deny any any) stance at the end, for example. The packet-tracer command can help you figure out if a rule is needed, by simulating packet traffic and telling you if it would be allowed, or where it would be blocked if denied.