Cisco ASA Series Cli Configuration Manual page 157

Chapter 1 Configuring the Transparent or Routed Firewall
An Inside User Visits a Web Server
Figure 1-9
Figure 1-9
The following steps describe how data moves through the ASA (see
1.
2.
3.
4.
5.
6.
shows an inside user accessing an outside web server.
Inside to Outside
www.example.com
Internet
209.165.201.2
The user on the inside network requests a web page from www.example.com.
The ASA receives the packet and adds the source MAC address to the MAC address table, if
required. Because it is a new session, it verifies that the packet is allowed according to the terms of
the security policy (access lists, filters, AAA).
For multiple context mode, the ASA first classifies the packet to a context.
The ASA records that a session is established.
If the destination MAC address is in its table, the ASA forwards the packet out of the outside
interface. The destination MAC address is that of the upstream router, 209.165.201.2.
If the destination MAC address is not in the ASA table, the ASA attempts to discover the MAC
address by sending an ARP request or a ping. The first packet is dropped.
The web server responds to the request; because the session is already established, the packet
bypasses the many lookups associated with a new connection.
The ASA forwards the packet to the inside user.
Management IP
209.165.201.6
Host
209.165.201.3
Cisco ASA Series CLI Configuration Guide
Firewall Mode Examples
Figure 1-9):
1-21