Cisco ASA functionality

[onslaught99]

Hello,

This may be a dumb question but I am trying to prove to our customer that our ASA 5525-X does not pass traffic when there is a hardware problem or if the firewall were to power off due to some catastrophic event. I planned on just powering down the ASA but they would prefer that I don't power down the firewall to prove that data does not pass traffic. I tried looking at any documentation but I can't seem to find where its documented that the ASA will not forward traffic while it is powered down or a hardware failure. Is there any documentation that points out that the ASA will not forward traffic if powered down? 

Thanks

[rvarelac · Accepted solution]

Hi onslaught99, 

I don't think it would be any documentation about this symptom. Is expected that if any network device  is powered down or have a hardware failure on one of his ports won't be able to forward any inbound or outbound traffic.

Hope it helps

-Randy-

[onslaught99]

Thank you both for the feedback. As expected I didn't believe that there was any documentation about this, just that it would be common knowledge that only certain devices would a "fail bypass" function because they are not truly needed for security boundary control. I know that certain IPS/IDS devices and the WAAS devices are able to perform the fail bypass function but the firewalls are needed to control and inspect traffic coming in.

Thanks again!!

[Marvin Rhoads · Accepted solution]

There's no documentation of that behavior that I have ever seen.

It's hard to prove a negative. Demonstration will show that's how it works though.

Devices that have this feature call it something like a "bypass mode interface". An example would be the high end IPS appliances like the 3D7125 and such. These "fail open" so that you don't lose connectivity in the event of a system outage.

[ipsthoughtexchange]

Hi,

This is not a dumb question, you have my sympathy for having to deal with a dumb person regarding this.

I'd explain it to that person as follows: If your light bulb expires, do still have light? - Hence, if an fw is powered down or an Interface is down there will as much traffic as light goes through a defective bulb.

BR