Network Wizkid's Technical Knowledge Base

If you’re a firewall engineer or work closely with the Cisco ASA then no doubt you will often find yourself troubleshooting and verifying reachability of packets on a network. One great feature that the ASA has to test reachability is the ‘packet-tracer’ command which when given an input will provide you with a very handy output that shows how the packet would be processed through the ASA. In this article, I will show you how we can use the packet-tracer command to verify ICMP reachability and we will also take a look at the process in which the ASA uses. For this demonstration, I am using an ASAv version (9.8) code. By default, ICMP is not inspected on the ASA and therefore all ICMP traffic will be dropped. In order to the allow ICMP, you need to inspect it and to do this we can add the following command to the ‘global_policy’ policy-map; class inspection_defaultinspect icmp Once you have configured the policy-map you can then configure ACL’s to permit ICMP traffic as you desire. In t...

In this article, I will share my notes on the ASA packet process for version 8.3+. Domain 1.0 off the CCIE Security version blueprint focuses on perimeter security and intrusion prevention, both of which include the ASA. In order to understand the ASA and how it works, it is important to understand how packets are processed as they enter the ASA. The packet comes into the ingress interface and the ASA checks to see if there are any existing connections. If a connection already exists, ACL’s are bypassed and the packet is sent straight to the packet inspection, this is also known as the fast path. If a connection doesn’t currently exist then the packet needs to be checked against ACL’s for any matches, we can also see by looking at the diagram above, that the packet will be untranslated before it is matched against the ACL rules. If an ACL match is found and it is permitted, the packet will be inspected, likewise, if the packet is not permitted it is dropped. When a connection doe...