Solved

ASA-Inspection Rules

Posted on 2011-09-21
5
960 Views
Last Modified: 2012-05-12
Hi,

What is the basic purpose of Inspection rules,how the rules works and what will happen if we remove the rule

Regaards
ramu
0
Comment
Question by:RAMU CH
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 18

Assisted Solution

by:jmeggers
jmeggers earned 167 total points
ID: 36575239
At basic, rules permit traffic from more secure interfaces (such as outside) to more secure interfaces.  You can apply rules anywhere, but they are absolutely needed in this way.  They allow granular control over what ports, protocols, source, addresses, destination addresses, etc. are allowed in from the less trusted side.
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 166 total points
ID: 36575634
Nope. Inspection rules enforce the stateful inspection of several (commonly used) protocols.
For example, if you enable stateful inspection for ftp, the ASA knows that when a connection comes in on port 21 (ftp) there can also be traffic on port 20 (ftp-data) from that same source.

Or as Cisco says:
Inspection rules configure protocol inspection on a device. Inspection opens temporary holes in your access rules to allow return traffic for connections initiated within your trusted network. When traffic is inspected, the device also implements additional controls to eliminate mal-formed packets based on the inspected protocols.

Source: http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.1/user/guide/fwinsp.html
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36575665
Oh, and reading the previous, you might imagine what happens if you remove them.

No worries though ;)  I've had issues where some rules had to be removed to make thing function properly.
0
 
LVL 5

Assisted Solution

by:Feroz Ahmed
Feroz Ahmed earned 167 total points
ID: 36708375
Hi,

Each Inpsection Rule has meaning and each rule defines a rule .for example if Inspect ICMP is not removed then one cannot ping from Inside Interface to outside Interface.If the same rule is implemented then one can ping from Inside Network to Outside network.likewise each inspection rule defines each rule .
0
 
LVL 1

Author Closing Comment

by:RAMU CH
ID: 36961038
Thanks
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month7 days, 5 hours left to enroll

622 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question