This allows for a cheap and secure connectivity solution between two or more LAN networks without leasing expensive dedicated WAN links between the two sites. Moreover, a site-to-site IPSec VPN can create a secured and encrypted connection between two distant private LAN networks over the Internet. This allows remote users to securely access data from outside of the corporate network using IPSec or SSL encryption protocols. The Virtual Private Network (VPN) tunnel protects all the traffic that is flowing from external devices to the corporate network over the public internet. Port Address Translation (PAT) allows the firewall to assign each device with a different port number which are mapped so that when the destination server responds to the public IP address the firewall knows which internal IP address originally sent the request and is able to forward on the packet.Īn ASA firewall is able to create an encrypted channel between the corporate network and another device located on a different network.

The second benefit is that many devices can access the internet using the single public IP address which saves on Public IP address use. Firstly, the actual IP address of the sending device is disguised because all the destination machine ever sees is the public IP address that has been substituted at the firewall and not the original private address. Network Address Translation and Port Address Translation are used to translate the IP address of the source device from a private IP address range to a public IP address range. This enables much more complex rules to be created and instead of only being able to block traffic based on source or destination IP addresses, rules can now be created to block traffic based on the protocol being used or to block a particular application. Packet filtering is able to determine what protocol is being used such as TCP, UDP, RTP etc and which application is sending this traffic. Packet filtering also known as Deep packet inspection goes much further than simply matching IP addresses to an allowed list. This means that all traffic from the specific security zone going out to other networks (zones) will pass through the ASA which will impose its firewall controls to the traffic.Ī Cisco ASA is able to carry out the following services in addition to the core Stateful Packet Inspection functionality: Cisco ASA Main Core Security Features Packet Filtering All hosts inside this security zone (subnet) will have as gateway the IP address configured on the ASA firewall interface. The Cisco ASA has many physical interfaces which can be further divided into “sub-interfaces” using VLANs.Įach one of these firewall interfaces is connected to a “security zone” which is basically a Layer 3 subnet.

Stateful packet inspection checks an access control list to see if the source or destination IP address (and/or ports) of the incoming packet is allowed access to the network or not. A network firewall is based on Stateful packet inspection, which I will explain below.Ī stateful network firewall, such as the Cisco ASA, typically uses stateful packet inspection to prevent unauthorised traffic from entering the network from the outside or prevent unauthorised traffic from being passed between security zones internally within a network.Ī stateful firewall keeps track of all the sessions that have been initiated from user devices inside the network and allows the responding traffic from outside the network to pass through to the initiating device. Let’s explain briefly what the core network firewall functionality is for the Cisco ASA. What is Adaptive Security Device Manager (ASDM).

Cisco asa 5505 software 8.4.6