Cisco ASA 5506-X Configuration Manual page 130

Application Layer Protocol Inspection
•
Figure 6-1
Client
In this figure, operations are numbered in the order they occur:
1.
2.
3.
4.
5.
6.
7.
The default configuration of the ASA includes a set of application inspection entries that associate
supported protocols with specific TCP or UDP port numbers and that identify any special handling
required.
When to Use Application Protocol Inspection
When a user establishes a connection, the ASA checks the packet against ACLs, creates an address
translation, and creates an entry for the session in the fast path, so that further packets can bypass
time-consuming checks. However, the fast path relies on predictable port numbers and does not perform
address translations inside a packet.
Many protocols open secondary TCP or UDP ports. The initial session on a well-known port is used to
negotiate dynamically assigned port numbers.
Cisco ASA Series Firewall CLI Configuration Guide
6-2
Connections (XLATE and CONN tables)—Maintains state and other information about each
established connection. This information is used by the Adaptive Security Algorithm and
cut-through proxy to efficiently forward traffic within established sessions.
How Inspection Engines Work
2
ASA
1
7
3
XLATE
CONN
A TCP SYN packet arrives at the ASA to establish a new connection.
The ASA checks the ACL database to determine if the connection is permitted.
The ASA creates a new entry in the connection database (XLATE and CONN tables).
The ASA checks the Inspections database to determine if the connection requires application-level
inspection.
After the application inspection engine completes any required operations for the packet, the ASA
forwards the packet to the destination system.
The destination system responds to the initial request.
The ASA receives the reply packet, looks up the connection in the connection database, and
forwards the packet because it belongs to an established session.
Chapter 6 Getting Started with Application Layer Protocol Inspection
ACL
6
5
Server
4
Inspection