16-12
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 16 Connection Settings
Configure Connection Settings
TCP State Bypass
NAT Guidelines
Because the translation session is established separately for each ASA, be sure to configure static NAT
on both ASAs for TCP state bypass traffic. If you use dynamic NAT, the address chosen for the session
on ASA 1 will differ from the address chosen for the session on ASA 2.
Configure TCP State Bypass
To bypass TCP state checking in asynchronous routing environments, carefully define a traffic class that
applies to the affected hosts or networks only, then enable TCP State Bypass on the traffic class using a
service policy. Because bypass reduces the security of the network, limit its application as much as
possible.
Procedure
Step 1
Create an L3/L4 class map to identify the hosts that require TCP State Bypass. Use an access-list match
to identify the source and destination hosts.
class-map
name
match
parameter
Example:
hostname(config)#
access-list bypass extended permit tcp host 10.1.1.1 host 10.2.2.2
hostname(config)#
class-map bypass-class
hostname(config-cmap)#
match access-list bypass
Step 2
Add or edit a policy map that sets the actions to take with the class map traffic, and identify the class
map.
policy-map
name
class
name
Example:
hostname(config)# policy-map global_policy
hostname(config-pmap)# class bypass-class
In the default configuration, the global_policy policy map is assigned globally to all interfaces. If you
want to edit the global_policy, enter global_policy as the policy name. For the class map, specify the
class you created earlier in this procedure.
Step 3
Enable TCP State Bypass on the class.
set connection advanced-options tcp-state-bypass
Step 4
If you are editing an existing service policy (such as the default global policy called global_policy), you
are done. Otherwise, activate the policy map on one or more interfaces.
service-policy
policymap_name
{
global
|
interface
interface_name
}
Example:
hostname(config)# service-policy global_policy global
The
global
keyword applies the policy map to all interfaces, and
interface
applies the policy to one
interface. Only one global policy is allowed. You can override the global policy on an interface by
applying a service policy to that interface. You can only apply one policy map to each interface.
Summary of Contents for ASA 5508-X
Page 11: ...P A R T 1 Access Control ...
Page 12: ......
Page 157: ...P A R T 2 Network Address Translation ...
Page 158: ......
Page 233: ...P A R T 3 Service Policies and Application Inspection ...
Page 234: ......
Page 379: ...P A R T 4 Connection Management and Threat Detection ...
Page 380: ......
