Packet Flow through Cisco ASA Firewall - ASA Packet Flow

[@AjayKumarYADAV12]

Aap ki teaching aur samjhne ki style acchi hai

[@imedita]

Glad the video content is useful. Keep watching, a new video is posted every Tuesday, Thursday and Saturday at 09 PM IST. Happy Learning. :-)

[@souvikdas6515]

What a beautiful explanation sir.... Thank you so much.

[@imedita]

Hi Souvik Das Glad the video content is useful. Keep watching, a new video is posted every Tuesday, Thursday and Saturday at 09 PM IST. Happy Learning. :-)

[@khurshidahmad7805]

Thank you Sir for explanation. I believed in Cisco ASA, the NAT is happening before ACL as we are using private IP address for inbound connection. Correct me Sir, if I'm wrong.

[@imedita]

You're welcome! You're absolutely correct. In Cisco ASA, NAT does indeed occur before ACL processing, especially when dealing with inbound connections using private IP addresses. Your understanding is spot on! If you have any more questions or need further clarification, feel free to ask.

[@khurshidahmad7805]

Thanks Sir, can I have the inbound Packet flow diagram to understand.

[@technicalshiv2336]

Thank you sir.

[@imedita]

Glad the video content is useful. Keep watching, a new video is posted every Tuesday, Thursday and Saturday at 09 PM IST. Happy Learning. :-)

[@rathodv16]

Thank You for sharing this , you have covered most of the point in easy to understand way specially about identity NAT, Just wanted to confirm when will be un-translation happen kindly correct me if am wrong ( This will be used in case of there in webserver inside accessible from public network using public is NATTED to private IP of webserver, this is same like Destination NAT in Palo alto

[@imedita]

Hi Rathod, Your statement is mostly correct. This will be used in cases where there is a webserver inside accessible from the public network using public NAT to the private IP of the webserver. This is similar to ASA Firewall and Destination NAT in Palo Alto Firewall.

[@imedita]

We are Glad the video content is useful. Keep watching; a new video is posted daily at 09 PM IST. Happy Learning. :-) KZbin Subscribe Link: kzbin.info ✅ For Admission, Call [phone] OR Chat with us on WhatsApp: wa.me/918750004411

[@manasp7888]

If an encrypted packet comes in ingress interface then where does it hit ? Will NOT the ASA decrypt it before point 6 ?

[@WAROCK777]

It will be applicable to remote-side ASA firewall.

[@imedita]

In the context of Cisco ASA (Adaptive Security Appliance) firewall, when an encrypted packet arrives at the ingress interface, it will go through the following steps: Ingress Interface: The encrypted packet is received on the ingress interface of the ASA. Access Control Policy: The ASA applies its access control policy to determine if the packet is allowed or denied based on configured rules. Decrypt (if necessary): If the packet matches an established IPsec VPN tunnel, the ASA will decrypt the packet using the appropriate encryption key. Routing Decision: Once decrypted, the ASA makes a routing decision based on the destination IP address of the packet. NAT (Network Address Translation): If configured, the ASA performs NAT translations on the packet, modifying the source and/or destination IP addresses. Egress Interface: The packet is then forwarded out through the appropriate egress interface based on the routing decision. It's important to note that the decryption process occurs after the access control policy is evaluated. If the packet is allowed by the access control policy and matches a valid VPN tunnel, it will be decrypted before proceeding with further processing, such as routing and NAT. I hope this clarifies the order of operations for an encrypted packet in the ASA firewall. Let me know if you have any additional questions!

[@AbhishekSingh-fi6sc]

at which step does the asa add the new connection entry in its connection table?

[@imedita]

Hi Abhishek In the packet flow through Cisco ASA, the ASA adds the new connection entry to its connection table at the "Input ACL" step

[@avinashpatil3734]

If you have a full course of Asa. Plese ping me

[@imedita]

Dear Avinash ASA Complete video course is available on this website: www.trainonic.com/ Also, It would be best to schedule a quick call with our team, our team will understand your requirements and share all the relevant information with you. Call our Helpline Number at [phone] or 𝐂𝐡𝐚𝐭 𝐰𝐢𝐭𝐡 𝐮𝐬 𝐨𝐧 𝐖𝐡𝐚𝐭𝐬𝐚𝐩𝐩: wa.me/918750004411