Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1126 / 2164

1-20
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Inspection of Basic Internet Protocols
ICMP Inspection
hostname(config)# policy-map type inspect http http_policy
hostname(config-pmap)# class http_url_policy
hostname(config-pmap-c)# log
ICMP Inspection
The ICMP inspection engine allows ICMP traffic to have a “session” so it can be inspected like TCP and
UDP traffic. Without the ICMP inspection engine, we recommend that you do not allow ICMP through
the ASA in an access list. Without stateful inspection, ICMP can be used to attack your network. The
ICMP inspection engine ensures that there is only one response for each request, and that the sequence
number is correct.
ICMP Error Inspection
When this feature is enabled, the ASA creates translation sessions for intermediate hops that send ICMP
error messages, based on the NAT configuration. The ASA overwrites the packet with the translated IP
addresses.
When disabled, the ASA does not create translation sessions for intermediate nodes that generate ICMP
error messages. ICMP error messages generated by the intermediate nodes between the inside host and
the ASA reach the outside host without consuming any additional NAT resource. This is undesirable
when an outside host uses the traceroute command to trace the hops to the destination on the inside of
the ASA. When the ASA does not translate the intermediate hops, all the intermediate hops appear with
the mapped destination IP address.
The ICMP payload is scanned to retrieve the five-tuple from the original packet. Using the retrieved
five-tuple, a lookup is performed to determine the original address of the client. The ICMP error
inspection engine makes the following changes to the ICMP packet:
•
In the IP Header, the mapped IP is changed to the real IP (Destination Address) and the IP checksum
is modified.
•
In the ICMP Header, the ICMP checksum is modified due to the changes in the ICMP packet.
•
In the Payload, the following changes are made:
–
Original packet mapped IP is changed to the real IP
–
Original packet mapped port is changed to the real Port
–
Original packet IP checksum is recalculated
Instant Messaging Inspection
This section describes the IM inspection engine. This section includes the following topics:
•
IM Inspection Overview, page 1-21
•
Configuring an Instant Messaging Inspection Policy Map for Additional Inspection Control,
page 1-21