Cisco ASA 5505 User Manual

Page 198

Advertising
background image

4-26

Cisco ASA 5500 Series Configuration Guide using the CLI

Chapter 4 Configuring the Transparent or Routed Firewall

Firewall Mode Examples

An Outside User Visits a Web Server on the Inside Network

Figure 4-11

shows an outside user accessing the inside web server.

Figure 4-11

Outside to Inside

The following steps describe how data moves through the ASA (see

Figure 4-11

):

1.

A user on the outside network requests a web page from the inside web server.

2.

The ASA receives the packet and adds the source MAC address to the MAC address table, if
required. Because it is a new session, it verifies that the packet is allowed according to the terms of
the security policy (access lists, filters, AAA).

For multiple context mode, the ASA first classifies the packet according to a unique interface.

3.

The ASA records that a session is established.

4.

If the destination MAC address is in its table, the ASA forwards the packet out of the inside
interface. The destination MAC address is that of the downstream router, 209.165.201.1.

If the destination MAC address is not in the ASA table, the ASA attempts to discover the MAC
address by sending an ARP request and a ping. The first packet is dropped.

5.

The web server responds to the request; because the session is already established, the packet
bypasses the many lookups associated with a new connection.

6.

The ASA forwards the packet to the outside user.

Host

209.165.201.2

209.165.201.1

209.165.200.230

Web Server

209.165.200.225

Management IP
209.165.201.6

Internet

92409

Advertising