Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

ASA-Inspection Rules

Posted on 2011-09-21
5
Medium Priority
?
971 Views
Last Modified: 2012-05-12
Hi,

What is the basic purpose of Inspection rules,how the rules works and what will happen if we remove the rule

Regaards
ramu
0
Comment
Question by:RAMU CH
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 18

Assisted Solution

by:jmeggers
jmeggers earned 668 total points
ID: 36575239
At basic, rules permit traffic from more secure interfaces (such as outside) to more secure interfaces.  You can apply rules anywhere, but they are absolutely needed in this way.  They allow granular control over what ports, protocols, source, addresses, destination addresses, etc. are allowed in from the less trusted side.
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 664 total points
ID: 36575634
Nope. Inspection rules enforce the stateful inspection of several (commonly used) protocols.
For example, if you enable stateful inspection for ftp, the ASA knows that when a connection comes in on port 21 (ftp) there can also be traffic on port 20 (ftp-data) from that same source.

Or as Cisco says:
Inspection rules configure protocol inspection on a device. Inspection opens temporary holes in your access rules to allow return traffic for connections initiated within your trusted network. When traffic is inspected, the device also implements additional controls to eliminate mal-formed packets based on the inspected protocols.

Source: http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/user/guide/fwinsp.html
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36575665
Oh, and reading the previous, you might imagine what happens if you remove them.

No worries though ;)  I've had issues where some rules had to be removed to make thing function properly.
0
 
LVL 5

Assisted Solution

by:Feroz Ahmed
Feroz Ahmed earned 668 total points
ID: 36708375
Hi,

Each Inpsection Rule has meaning and each rule defines a rule .for example if Inspect ICMP is not removed then one cannot ping from Inside Interface to outside Interface.If the same rule is implemented then one can ping from Inside Network to Outside network.likewise each inspection rule defines each rule .
0
 
LVL 1

Author Closing Comment

by:RAMU CH
ID: 36961038
Thanks
0

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question