What happens if i allow traffic on 1 interface, but deny that traffic on the responding interface?

[Eric Snijders]

It might look like a weird question, but i actually have a experimental case for this one.
Pretty simple:

1. Let's say i permit tcp/443 from anyone on the outside to PC01.

2. Now i want to block specific traffic on the way back, so on the Inside to a specific host.

Why? I'm investigating some weird return traffic. I just made this test setup in GNS3 and it seems that if i block tcp/443 on the Inside, it indeed blocks everything, so there will be no connection. 

Is there any way i can block specific traffic only if there is no valid connection on the ASA? Cause the traffic i'm investigating seems to be traffic AFTER the TCP connection was already closed, but somehow it's still hitting a permit rule.

[mkazam001]

Hi Eric,

I would run the asa packet-capture on both interfaces to confirm your hypothesis. Also try sh conn | i x.x.x.x - the ip address.

The connection from the outside-in will cause the asa to create an entry in the state-table, so the return traffic from the lan-outside will bypass any acl on the interface, as the connection already exists.

Regards, mk