Traffic by default on an ASA is automatically allowed from a higher to lower security interface with the inside interface generally having a security level of 100 and the outside interface generally having a security level of 0. They are applied to interfaces on the ASA and can be applied either inbound or outbound but usually they are applied inbound. If w1 had sent the same packet back but the host 192.168.5.10 has never sent the original packet then the ASA would not have a record in it's state table and therefore it would drop the packet.Īccess-lists (acls) are used to allow or deny traffic. Now the above example is somewhat simplified because i didn't go into the TCP flags etc, or cover UDP which doesn't have flags, but put simply that is how a stateful firewall works. So it knows this packet is valid and it allows it back in. When the ASA receives the packet it looks at it's state table and sees that there was a corresponding packet sent out. It also records the TCP flag and sequence number in the packet. The ASA receives the packet and records the above information in the state table.

H1 wants to look at a web page on w1 so it sends a packet to w1 (note that 192.168.5.10 is not a valid internet address but i'll cover that in the NAT bit) H1 -> (inside) ASA (outside) -> Internet -> w1 That is the essence of a stateful firewall. When the return packet arrives on the outside interface the ASA checks it against the information it previously recorded and if there is a match it allows the packet in. So it if sees a packet go out from inside to outside it records certain information in that packet. What this means is it keep track of connections through the firewall.

I have the link below and tried to read it but it is too hard/technical for me to understand (knowing I am newbie in Firewall). I would like to ask help regarding basic concept of ASA, basic configuration, how routing works, modes, role of ACL and NAT translation.

Cisco asa 5505 configuration guide pdf