Cisco Systems IPsec Pass Through Inspection

11-45
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter11 Configuring Inspection of Basic Internet Protocols
IPsec Pass Through Inspection
– Allow packets with the No Operation (NOP) option
The Options field in the IP header can contain zero, one, or more options, which makes the total
length of the field variable. However, the IP header must be a multiple of 32 bits. If the number of
bits of all options is not a multiple of 32 bits, the NOP option is used as “internal padding” to align
the options on a 32-bit boundary.
– Allow packets with the Router Alert (RTRALT) option
This option notifies transit routers to inspect the contents of the packet even when the packet is not
destined for that router. This inspection is valuable when implementing RSVP and similar protocols
require relatively complex processing from the routers along the packets delivery path.
– Clear the option value from the packets
When an option is checked, the Clear the option value from the packets check box becomes
available for that option. Select the Clear the option value from the packets check box to clear the
option from the packet before allowing the packet through the ASA.
IPsec Pass Through Inspection
This section describes the IPsec Pass Through inspection engine. This section includes the following
topics:
•IPsec Pass Through Inspection Overview, page11-45
•Select IPsec-Pass-Thru Map, page11-46
•IPsec Pass Through Inspect Map, page11-46
•Add/Edit IPsec Pass Thru Policy Map (Security Level), page11-47
•Add/Edit IPsec Pass Thru Policy Map (Details), page11-47
IPsec Pass Through Inspection Overview
Internet Protocol Security (IPsec) is a protocol suite for securing IP communications by authenticating
and encrypting each IP packet of a data stream. IPsec also includes protocols for establishing mutual
authentication between agents at the beginning of the session and negotiation of cryptographic keys to
be used during the session. IPsec can be used to protect data flows between a pair of hosts (for example,
computer users or servers), between a pair of security gateways (such as routers or firewalls), or between
a security gateway and a host.
IPsec Pass Through application inspection provides convenient traversal of ESP (IP protocol 50) and AH
(IP protocol 51) traffic associated with an IKE UDP port 500 connection. It avoids lengthy ACL
configuration to permit ESP and AH traffic and also provides security using timeout and max
connections.
Specify IPsec Pass Through inspection parameters to identify a specific map to use for defining the
parameters for the inspection. Configure a policy map for Specify IPsec Pass Through inspection to
access the parameters configuration, which lets you specify the restrictions for ESP or AH traffic. You
can set the per client max connections and the idle timeout in parameters configuration.
NAT and non-NAT traffic is permitted. However, PAT is not supported.