ASA packet processing algorithm

The ASA uses a particular packet flow order of operations to process packets. The process algorithm differs somewhat depending upon the version of the ASA. The packet processing algorithm indicated here is for ASA versions 8.3 and later, and include the participation of the FirePOWER module, if used.

The following diagram describes the process:

cisco-firepower-packet-flow.excalidraw

The process takes place as follows:

  • Step 1. A packet is received on a given interface of the Cisco ASA. If a VPN is configured, the packet is decrypted at this point. If ACL bypass is configured for VPN traffic, the Cisco ASA proceeds to step 5.

  • Step 2. The Cisco ASA checks to see if there is an existing connection for the source and destination hosts for that specific traffic. If there is an existing connection, the Cisco ASA bypasses the Access-List (ACL) checks and performs application inspection checks and proceeds to step 5.

  • Step 3. If there is no existing connection for that traffic, the Cisco ASA performs the NAT checks (or untranslate process).

  • Step 4. The Cisco ASA allows or denies traffic based on the rules in the configured ACLs.

  • Step 5. If traffic is allowed, the Cisco ASA performs application inspection.

  • Step 6. The Cisco ASA forwards the packet to the Cisco ASA FirePOWER module. If promiscuous monitor-only mode is configured, only a copy of the packet is sent to the Cisco ASA FirePOWER module. If the Cisco ASA FirePOWER module is configured in inline mode, the packet is inspected and dropped if it does not conform to security policies. If the packet is compliant with security policies and Cisco ASA FirePOWER module protection capabilities, it is sent back to the ASA for processing.

  • Step 7. The Cisco ASA determines the egress interface based on NAT or Layer 3 routing.

  • Step 8. Layer 3 routing is performed.

  • Step 9. Layer 2 address lookup occurs.

  • Step 10. The packet is sent to the network.

For the slightly different packet processing algorithm of the ASA up to version 8.2, it's best to check the Cisco documentation.