Cisco ASA Series Cli Configuration Manual page 153

Chapter 1 Configuring the Transparent or Routed Firewall
An Inside User Visits a Web Server on the DMZ
Figure 1-5
Figure 1-5
Inside
User
10.1.2.27
The following steps describe how data moves through the ASA (see
1.
2.
3.
4.
5.
An Outside User Attempts to Access an Inside Host
Figure 1-6
shows an inside user accessing the DMZ web server.
Inside to DMZ
Outside
209.165.201.2
10.1.2.1 10.1.1.1
Web Server
10.1.1.3
A user on the inside network requests a web page from the DMZ web server using the destination
address of 10.1.1.3.
The ASA receives the packet and because it is a new session, the ASA verifies that the packet is
allowed according to the terms of the security policy (access lists, filters, AAA).
For multiple context mode, the ASA first classifies the packet to a context.
The ASA then records that a session is established and forwards the packet out of the DMZ interface.
When the DMZ web server responds to the request, the packet goes through the fast path, which lets
the packet bypass the many lookups associated with a new connection.
The ASA forwards the packet to the inside user.
shows an outside user attempting to access the inside network.
DMZ
Cisco ASA Series CLI Configuration Guide
Firewall Mode Examples
Figure 1-5):
1-17