Solved

ASA-Inspection Rules

Posted on 2011-09-21
5
916 Views
Last Modified: 2012-05-12
Hi,

What is the basic purpose of Inspection rules,how the rules works and what will happen if we remove the rule

Regaards
ramu
0
Comment
Question by:RAMU CH
5 Comments
 
LVL 18

Assisted Solution

by:jmeggers
jmeggers earned 167 total points
ID: 36575239
At basic, rules permit traffic from more secure interfaces (such as outside) to more secure interfaces.  You can apply rules anywhere, but they are absolutely needed in this way.  They allow granular control over what ports, protocols, source, addresses, destination addresses, etc. are allowed in from the less trusted side.
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 166 total points
ID: 36575634
Nope. Inspection rules enforce the stateful inspection of several (commonly used) protocols.
For example, if you enable stateful inspection for ftp, the ASA knows that when a connection comes in on port 21 (ftp) there can also be traffic on port 20 (ftp-data) from that same source.

Or as Cisco says:
Inspection rules configure protocol inspection on a device. Inspection opens temporary holes in your access rules to allow return traffic for connections initiated within your trusted network. When traffic is inspected, the device also implements additional controls to eliminate mal-formed packets based on the inspected protocols.

Source: http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/user/guide/fwinsp.html
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36575665
Oh, and reading the previous, you might imagine what happens if you remove them.

No worries though ;)  I've had issues where some rules had to be removed to make thing function properly.
0
 
LVL 5

Assisted Solution

by:Feroz Ahmed
Feroz Ahmed earned 167 total points
ID: 36708375
Hi,

Each Inpsection Rule has meaning and each rule defines a rule .for example if Inspect ICMP is not removed then one cannot ping from Inside Interface to outside Interface.If the same rule is implemented then one can ping from Inside Network to Outside network.likewise each inspection rule defines each rule .
0
 
LVL 1

Author Closing Comment

by:RAMU CH
ID: 36961038
Thanks
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

937 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now