Protocols allowed to pass ASA

[mahesh18]

Hi Everyone,

Need to know how can we tell from sh run config that what protocols are allowed means ASA is not doing any inspection

on them or we can say it is not blocking -    when traffic passes through the ASA?

Also is there any command which we can use from CLI to check this?

Thanks

Mahesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

You have different options

Run a packet-tracer will definelty let you know all the traffic rules that a particular flow takes.

packet-tracer input interface_name_if tcp/udp source_ip source_port destination_ip destination_port

Or just by checking inspection policies, ACL's, Nat rules.

[mahesh18]

Hi Julio,

If sh run shows following configuration

case1

policy-map global_policy

class inspection_default

  inspect icmp ***************************************

service-policy global_policy global

Does inspect icmp  here means that allow icmp if ping is sourced from inside of the network?

Need to know the exact purpose of inspect command in ASA config???

policy-map global_policy  ---  does it mean that it applies  to whole ASA  traffic ?

******************************************************************************************************************

service-policy global_policy global ----Purpose of this command?

Thanks

Mahesh

[Julio Carvajal · Accepted solution]

Hello,

That means that if ICMP connection  is allowed on 'X" interface the returning traffic will be allowed because of the inspection ( session will be on the connection table of the ASA)

policy-map global_policy  ---  does it mean that it applies  to whole ASA  traffic ?

No, that is just the name of the policy.

The command that defines where to set this up is the service-policy and ofcourse a global means all over the interfaces.

Regards,

[mahesh18]

Hi Julio,

Many Thanks again

Regards

Mahesh