Cisco ASA 5505 Configuration Manual page 845

Chapter 37 Configuring Inspection of Basic Internet Protocols
TFTP Inspection
The adaptive security appliance inspects TFTP traffic and dynamically creates connections and
translations, if necessary, to permit file transfer between a TFTP client and server. Specifically, the
inspection engine inspects TFTP read request (RRQ), write request (WRQ), and error notification
(ERROR).
A dynamic secondary channel and a PAT translation, if necessary, are allocated on a reception of a valid
read (RRQ) or write (WRQ) request. This secondary channel is subsequently used by TFTP for file
transfer or error notification.
Only the TFTP server can initiate traffic over the secondary channel, and at most one incomplete
secondary channel can exist between the TFTP client and server. An error notification from the server
closes the secondary channel.
TFTP inspection must be enabled if static PAT is used to redirect TFTP traffic.
Cisco ASA 5500 Series Configuration Guide using ASDM
37-61
OL-20339-01