For udp and icmp, they go thru timeouts(2 minutes for udp and 2 seconds from icmp) because there is not state involved, which can be tuned by timeout conn. If the return packet takes a longer time than configured timeout, they are dropped or send icmp message back to sender. But no ACL is needed for return traffic on ASA
http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/t.html#wp1540870 On Thu, Oct 9, 2014 at 4:07 PM, Randy via cisco-nsp < [email protected]> wrote: > Yes, for return traffic a hole will be punched through to allow - state is > maintained - so for a syn initiated from inside as long it is allowed by > acl on inside interface; the syn-ack will be allowed. > > The deny ip any any on outside will not allow anything initiated from the > outside to make it in. > > ./Randy > > > > ----- Original Message ----- > From: Christopher Werny <[email protected]> > To: "[email protected]" <[email protected]> > Cc: > Sent: Thursday, October 9, 2014 12:42 PM > Subject: [c-nsp] Cisco ASA return traffic with explicit deny on outside > interface > > Good Evening, > > I know that might seem a simple and easy question, but I wasn't able to > find an exact answer (but maybe my google-fu has just failed me or my brain > just needs some sleep). > > I have an ASA running 8.4 in a pretty simple setup with 2 interfaces > (inside/outside). I have to 2 ACLs where one is applied inbound on the > inside, and one ACL applied inbound on the outside interface. The outside > ACL has an explicit deny ip any any statement for logging purposes. > > I am wondering, does return traffic (for connections originated on the > inside network) get through the ASA with the explicit deny ip any any > statement in the outside ACL? I know it works without an ACL applied to > the outside interface, but the explicit deny got me thinking. I haven't a > device with me to test it unfortunately > > Thanks for your time. > > Best, > Christopher > > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
