cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4018
Views
20
Helpful
6
Replies

How to support TCP Fast Open (RFC 7413) on ASA-Firewalls?

CaB
Level 1
Level 1

 Hi,

how do I enable the support for TFO (RFC 7413) in Cisco Adaptive Security Appliance Software Version 9.2 ?

It seems not to work out of the box, i.e. normal connection establishment  (handshake without application data bytes) works well while TFO (syn,syn-ack with application data bytes) connection establishment is rejected.

 

Regards,

 CaB

1 Accepted Solution

Accepted Solutions

Jerome BERTHIER
Level 1
Level 1

Hi

 

ASA can do TCP normalization :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#69801

 

You can modify it with TCP map :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#53790

 

but as far as I see, per default, SYN with data is supported but not SYN/ACK with data:

synack-data { allow | drop }

Sets the action for TCP SYNACK packets that contain data.

The allow keyword allows TCP SYNACK packets that contain data.

(Default) The drop keyword drops TCP SYNACK packets that contain data.

syn-data { allow | drop }

Sets the action for SYN packets with data.

(Default) The allow keyword allows SYN packets with data.

The drop keyword drops SYN packets with data.

 

Regards

 

 

 

 

View solution in original post

6 Replies 6

#Mat
Level 6
Level 6

Hi, I don't see this RFC supported by ASA 

https://www.cisco.com/c/en/us/td/docs/security/asa/roadmap/asa_new_features.html

 

As workaround/test I think you could try with TCP state bypass.

 

Regards.-

 

 

 

 

 

.

Jerome BERTHIER
Level 1
Level 1

Hi

 

ASA can do TCP normalization :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#69801

 

You can modify it with TCP map :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-connlimits.html#53790

 

but as far as I see, per default, SYN with data is supported but not SYN/ACK with data:

synack-data { allow | drop }

Sets the action for TCP SYNACK packets that contain data.

The allow keyword allows TCP SYNACK packets that contain data.

(Default) The drop keyword drops TCP SYNACK packets that contain data.

syn-data { allow | drop }

Sets the action for SYN packets with data.

(Default) The allow keyword allows SYN packets with data.

The drop keyword drops SYN packets with data.

 

Regards

 

 

 

 

Hi Jerome,

 

that was a very helpfull hint. I have started to modify the tcp normalization by allowing data in syn-acks.

syn-ack allow

As this did not fix the problem I configured the tcp map to be most liberal, i.e.:

tcp-map tcp-map-test
  synack-data allow
  invalid-ack allow
  tcp-options range 6 7 allow
  tcp-options range 9 255 allow
  urgent-flag allow

 

Next week I will try to figure out which of the options are necessary in order to allow TFO.

Regards,

 CaB

@CaB

Did you ever get this to work, or is it maybe anyway supported now?

Hi patoberli,

 

yes, I got it to work. Here are the code snippets:

 

tcp-map tcp-map-fastopen
  synack-data allow
  tcp-options range 6 7 allow
  tcp-options range 9 255 allow

 

You will need a class map to match the tcp stream:

 

class-map TCP
 match port tcp range 1 65535

 

And you have to apply it in the policy section:

 

policy-map global_policy
class inspection_default
inspect ftp
...
inspect dns dns-map-60
class TCP
set connection random-sequence-number disable
set connection advanced-options tcp-map-fastopen

 

So the example above will apply the support for tcp fastopen to all tcp connections as the class map (TCP) matches any tcp port.

 

Regards,

CaB

Thanks a lot for your detailed answer!
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: