Cisco ASA Series Cli Configuration Manual page 92

Firewall Functional Overview
•
In routed mode, the ASA is considered to be a router hop in the network.
In transparent mode, the ASA acts like a "bump in the wire," or a "stealth firewall," and is not considered
a router hop. The ASA connects to the same network on its inside and outside interfaces.
You might use a transparent firewall to simplify your network configuration. Transparent mode is also
useful if you want the firewall to be invisible to attackers. You can also use a transparent firewall for
traffic that would otherwise be blocked in routed mode. For example, a transparent firewall can allow
multicast streams using an EtherType access list.
Stateful Inspection Overview
All traffic that goes through the ASA is inspected using the Adaptive Security Algorithm and either
allowed through or dropped. A simple packet filter can check for the correct source address, destination
address, and ports, but it does not check that the packet sequence or flags are correct. A filter also checks
every packet against the filter, which can be a slow process.
Note
The TCP state bypass feature allows you to customize the packet flow. See the
section on page
A stateful firewall like the ASA, however, takes into consideration the state of a packet:
•
•
Cisco ASA Series CLI Configuration Guide
1-30
Transparent
1-3.
Is this a new connection?
If it is a new connection, the ASA has to check the packet against access lists and perform other
tasks to determine if the packet is allowed or denied. To perform this check, the first packet of the
session goes through the "session management path," and depending on the type of traffic, it might
also pass through the "control plane path."
The session management path is responsible for the following tasks:
–
Performing the access list checks
–
Performing route lookups
–
Allocating NAT translations (xlates)
–
Establishing sessions in the "fast path"
The ASA creates forward and reverse flows in the fast path for TCP traffic; the ASA also creates
connection state information for connectionless protocols like UDP, ICMP (when you enable ICMP
inspection), so that they can also use the fast path.
Note
For other IP protocols, like SCTP, the ASA does not create reverse path flows. As a result,
ICMP error packets that refer to these connections are dropped.
Some packets that require Layer 7 inspection (the packet payload must be inspected or altered) are
passed on to the control plane path. Layer 7 inspection engines are required for protocols that have
two or more channels: a data channel, which uses well-known port numbers, and a control channel,
which uses different port numbers for each session. These protocols include FTP, H.323, and SNMP.
Is this an established connection?
Chapter 1 Introduction to the Cisco ASA
"TCP State Bypass"