Cisco ASA Packet Process Algo

 Here is a diagram of how the Cisco ASA processes the packet that it receives-

A: The packet is reached at the ingress interface.

B: Once the packet reaches the internal buffer of the interface, the input counter of the interface is incremented by one.

#show interface

C: ASA first looks at its internal connection table details in order to verify if this is a current connection. If the packet flow matches a current connection, then the Access Control List (ACL) check is bypassed and the packet is moved forward.

#show conn

Syslog message when there is no connection entry:

%ASA-6-106015: Deny TCP (no connection) from IP_address/port to

 IP_address/port flags tcp_flags on interface interface_name

D: If packet flow does not match a current connection, then the TCP state is verified. If it is a SYN packet or UDP (User Datagram Protocol) packet, then the connection counter is incremented by one and the packet is sent for an ACL check. If it is not a SYN packet, the packet is dropped and the event is logged.

#show access-list

Syslog message when the packet is denied by an ACL:

%ASA-4-106023: Deny protocol src [interface_name:source_address/source_port]

 dst interface_name:dest_address/dest_port by access_group acl_ID

E: The packet is processed as per the interface ACLs. It is verified in sequential order of the ACL entries and if it matches any of the ACL entries, it moves forward. Otherwise, the packet is dropped and the information is logged. The ACL hit count is incremented by one when the packet matches the ACL entry.

F: The packet is verified for the translation rules. If a packet passes through this check, then a connection entry is created for this flow and the packet moves forward. Otherwise, the packet is dropped and the information is logged.

#show xlate

Syslog message when there is no translation rule found:

%ASA-3-305005: No translation group found for protocol src interface_name:

 source_address/source_port dst interface_name:dest_address/dest_port

G: The packet is subjected to an Inspection Check. This inspection verifies whether or not this specific packet flow is in compliance with the protocol. ASA has a built-in inspection engine that inspects each connection as per its pre-defined set of application-level functionality. If it passed the inspection, it is moved forward. Otherwise, the packet is dropped and the information is logged.

#show service-policy inspect

Syslog message when a packet is denied by Security Inspection:

%ASA-4-405104: H225 message received from outside_address/outside_port to

 inside_address/inside_port before SETUP

H: Additional security checks will be implemented if a Content Security (CSC) module is involved.

#show run static

I: The IP header information is translated as per the Network Address Translation/ Port Address Translation (NAT/PAT) rule and checksums are updated accordingly. The packet is forwarded to Advanced Inspection and Prevention Security Services Module (AIP-SSM)  for IPS related security checks when the AIP module is involved.

#show run nat

J: The packet is forwarded to the egress interface based on the translation rules. If no egress interface is specified in the translation rule, then the destination interface is decided based on the global route lookup.

#show run global

K: On the egress interface, the interface route lookup is performed. Remember, the egress interface is determined by the translation rule that takes the priority.

#show nat

L: Once a Layer 3 route has been found and the next hop identified, Layer 2 resolution is performed. The Layer 2 rewrite of the MAC header happens at this stage.

#show route

#show arp

Syslog message when there is no route information:

%ASA-6-110003: Routing failed to locate next-hop for protocol from src

 interface:src IP/src port to dest interface:dest IP/dest port

M: The packet is transmitted on the wire, and interface counters increment on the egress interface.

Thanks

Himanshu