4/28/2017 ASA8.

2:PacketFlowthroughanASAFirewallCisco

CiscoASAPacketProcessAlgorithm

HereisadiagramofhowtheCiscoASAprocessesthepacketthatit
receives:

Herearetheindividualstepsindetail:
1. Thepacketisreachedattheingressinterface.
2. Oncethepacketreachestheinternalbufferoftheinterface,theinput
counteroftheinterfaceisincrementedbyone.
3. CiscoASAfirstlooksatitsinternalconnectiontabledetailsinorderto
verifyifthisisacurrentconnection.Ifthepacketflowmatchesa
currentconnection,thentheAccessControlList(ACL)checkis
bypassedandthepacketismovedforward.
Ifpacketflowdoesnotmatchacurrentconnection,thentheTCPstate
isverified.IfitisaSYNpacketorUDP(UserDatagramProtocol)
packet,thentheconnectioncounterisincrementedbyoneandthe
packetissentforanACLcheck.IfitisnotaSYNpacket,thepacketis
droppedandtheeventislogged.
4. ThepacketisprocessedaspertheinterfaceACLs.Itisverifiedin
sequentialorderoftheACLentriesandifitmatchesanyoftheACL
entries,itmovesforward.Otherwise,thepacketisdroppedandthe
informationislogged.TheACLhitcountisincrementedbyonewhen
thepacketmatchestheACLentry.
5. Thepacketisverifiedforthetranslationrules.Ifapacketpasses
throughthischeck,thenaconnectionentryiscreatedforthisflowand
thepacketmovesforward.Otherwise,thepacketisdroppedandthe
informationislogged.
6. ThepacketissubjectedtoanInspectionCheck.Thisinspection
http://www.cisco.com/c/en/us/support/docs/security/asa5500xseriesnextgenerationfirewalls/113396asapacketflow00.html 1/3
4/28/2017 ASA8.2:PacketFlowthroughanASAFirewallCisco
6. ThepacketissubjectedtoanInspectionCheck.Thisinspection
verifieswhetherornotthisspecificpacketflowisincompliancewith
theprotocol.CiscoASAhasabuiltininspectionenginethatinspects
eachconnectionasperitspredefinedsetofapplicationlevel
functionality.Ifitpassedtheinspection,itismovedforward.Otherwise,
thepacketisdroppedandtheinformationislogged.
AdditionalsecuritycheckswillbeimplementedifaContentSecurity
(CSC)moduleisinvolved.
7. TheIPheaderinformationistranslatedaspertheNetworkAddress
Translation/PortAddressTranslation(NAT/PAT)ruleandchecksums
areupdatedaccordingly.ThepacketisforwardedtoAdvanced
InspectionandPreventionSecurityServicesModule(AIPSSM)for
IPSrelatedsecuritycheckswhentheAIPmoduleisinvolved.
8. Thepacketisforwardedtotheegressinterfacebasedonthe
translationrules.Ifnoegressinterfaceisspecifiedinthetranslation
rule,thenthedestinationinterfaceisdecidedbasedontheglobalroute
lookup.
9. Ontheegressinterface,theinterfaceroutelookupisperformed.
Remember,theegressinterfaceisdeterminedbythetranslationrule
thattakesthepriority.
10. OnceaLayer3routehasbeenfoundandthenexthopidentified,
Layer2resolutionisperformed.TheLayer2rewriteoftheMAC
headerhappensatthisstage.
11. Thepacketistransmittedonthewire,andinterfacecountersincrement
ontheegressinterface.

ExplanationofNAT

RefertothesedocumentsformoredetailsontheorderofNAT
operation:
CiscoASASoftwareVersion8.2andearlier
http://www.cisco.com/c/en/us/support/docs/security/asa5500xseriesnextgenerationfirewalls/113396asapacketflow00.html 2/3
4/28/2017 ASA8.2:PacketFlowthroughanASAFirewallCisco

CiscoASASoftwareVersion8.3andlater

ShowCommands

Herearesomeusefulcommandsthathelptrackthepacketflowdetails
atdifferentstagesintheprocess:
showinterface
showconn
showaccesslist
showxlate
showservicepolicyinspect
showrunstatic
showrunnat
showrunglobal
shownat
showroute
showarp

http://www.cisco.com/c/en/us/support/docs/security/asa5500xseriesnextgenerationfirewalls/113396asapacketflow00.html 3/3