CISCO FIREWALL HANDBOOK
CISCO ASA, PIX, AND FWSM FIREWALL HANDBOOK ON LINE 1, THE ECHO REQUEST ICMP PACKET IS RECEIVED ON THE OUTSIDE INTERFACE LINE 2 SHOWS THE XLATE ENTRY BEING USED WHICH IS AN "UNTRANSLATION" TOWARD THE INSIDE HOST PC-2 LINE 3 RECORDS THE ECHO REPLY RETURNING TOWARD PC-1 LINE 4 SHOWS THAT THE XLATE ENTRY HAS BEEN USED AGAIN, IN THE FORWARD DIRECTION TOWARD PC-1 AS SOON AS THE XLATE ENTRIES ARE IN PLACE AND THE ACLS PERMIT THE TRAFFIC, THE TWO HOSTS ARE FREE TO SEND ICMP PACKETS TO EACH OTHER IN FACT, OTHER HOSTS MIGHT ALSO BE ABLE TO SEND ICMP PACKETS TO THEM TOO, IF THE XLATE ENTRY EXISTS FOR THE DESTINATION HOST AND THE ACL PERMITS IT IF NAT IS USED, THE XLATE ENTRIES REMAIN IN EFFECT FOR THE DURATION OF A CONNECTION OR UNTIL THE STATIC NAT ENTRY IS REMOVED FROM THE CONFIGURATION FOR DYNAMIC PORT ADDRESS TRANSLATION (PAT), HOWEVER, THE FIREWALL SIMPLY ALLOWS THE ICMP PACKETS TO CONTINUE UNTIL A FIXED 30-SECOND IDLE TIME HAS EXPIRED THE FOLLOWING OUTPUT DEMONSTRATES THIS SCENARIO NOTE AS A PART OF THE ICMP INSPECTION ENGINE, ASA RELEASES 7 0(1) AND LATER, AS WELL AS FWSM 3 1(1) AND LATER, HAVE MUCH TIGHTER CONTROL OVER ICMP ACTIVITY THE FIREWALL PERMITS ONLY A SINGLE REPLY TO ANY ICMP REQUEST THAT PASSES THROUGH IT ALTHOUGH THE ICMP XLATE ENTRY MIGHT REMAIN ACTIVE UNTIL THE 30-SECOND IDLE TIMER EXPIRES, ANY ACTUAL ICMP RETURN TRAFFIC AFTER THE FIRST REPLY PACKET IS DROPPED IF NAT IS USED FOR THE XLATE ENTRY, THE FIREWALL ALLOWS THE ICMP CONNECTION TO REMAIN OPEN FOR FIREWALL # SHOW XLATE LOCAL 172 21 4 2 DEBUG 14360 IN USE, 34527 MOST USED FLAGS: D - DNS, D - DUMP, I - IDENTITY, I - INSIDE, N - NO RANDOM, O - OUTSIDE, R - PORTMAP, S - STATIC FIREWALL # A PING HAS CREATED A DYNAMIC XLATE ENTRY, AND THAT ENTRY HAS BEEN IDLE FOR 29 SECONDS NOTICE THAT THE TIMEOUT VALUE IS 30 SECONDS, WHICH IS A FIXED VALUE FOR ICMP ENTRIES ONE SECOND LATER, THE XLATE ENTRY HAS BEEN DELETED FROM THE TABLE CISCO ASA, PIX, AND FWSM FIREWALL HANDBOOK NOTICE THAT THE ICMP CONNECTION WAS BUILT AND TORN DOWN WITHIN THE SAME SECOND OF TIME, IMMEDIATELY AFTER THE ECHO REPLY WAS RECEIVED THE LAST LINE SHOWS THAT THE XLATE ENTRY STAYED ACTIVE UNTIL THE 30-SECOND IDLE TIMER EXPIRED UDP INSPECTION CISCO ASA, PIX, AND FWSM FIREWALL HANDBOOK