An Outside User Attempts To Access An Inside Host - Cisco FirePOWER ASA 5500 series Configuration Manual

Transparent Mode Overview
4.
5.
6.

An Outside User Attempts to Access an Inside Host

Figure 15-11
Figure 15-11
The following steps describe how data moves through the security appliance (see
1.
2.
3.
Cisco Security Appliance Command Line Configuration Guide
15-14
If the destination MAC address is in its table, the security appliance forwards the packet out of the
inside interface. The destination MAC address is that of the downstream router, 209.186.201.1.
If the destination MAC address is not in the security appliance table, the security appliance attempts
to discover the MAC address by sending an ARP request and a ping. The first packet is dropped.
When the web server responds to the request, the security appliance adds the web server
MAC address to the MAC address table, if required, and because the session is already established,
the packet bypasses the many lookups associated with a new connection.
The security appliance forwards the packet to the outside user.
shows an outside user attempting to access a host on the inside network.
Outside to Inside
Host
Internet
209.165.201.2
Management IP
209.165.201.6
A user on the outside network attempts to reach an inside host.
The security appliance receives the packet and adds the source MAC address to the MAC address
table, if required. Because it is a new session, it verifies if the packet is allowed according to the
terms of the security policy (access lists, filters, AAA).
For multiple context mode, the security appliance first classifies the packet according to a unique
interface.
The packet is denied, and the security appliance drops the packet.
Host
209.165.201.3
Chapter 15 Firewall Mode Overview
Figure 15-11):
OL-10088-01