ASA access list for established TCP connections

[matthew.norman]

Hello all,

I am trying to add an inbound firewall rule to allow tcp from any host if the connection was established from the inside.

I have tried this but don't get the option for the established keyword.

Can anyone advise if I am missing something?

access-list IN-BASIC-PERMIT extended permit tcp any any ***

ASA version is 8.4.

Thanks

Matt

[Pawan Raut · Accepted solution]

Cisco ASA are stateful so you dont need to add additional rule for established like in Cisco router 

[matthew.norman]

Hi Pawan,

Thank you for the quick reply.

So if I understand correctly, anything that goes out of the firewall is allowed back in as it is automatically determined as established?

Regards

Matt

[Pawan Raut]

Yes thats why we called it as stateful Firewall. If foreward tarffic for any connection allowed  then return traffic for that connection is permitted by default.

Regards,

Pawan (CCIE #52104)

Kindly rate for useful post