Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6

check-retransmission

Prevents inconsistent TCP retransmissions.

checksum-verification

Verifies the checksum.

exceed-mss { allow | drop }

Sets the action for packets whose data length exceeds the TCP maximum segment size.

(Default) The allow keyword allows packets whose data length exceeds the TCP maximum segment size.

The drop keyword drops packets whose data length exceeds the TCP maximum segment size.

invalid-ack { allow | drop }

Sets the action for packets with an invalid ACK. You might see invalid ACKs in the following instances:

• In the TCP connection SYN-ACK-received status, if the ACK number of a received TCP packet is not exactly same as the sequence number of the next TCP packet sending out, it is an invalid ACK.
• Whenever the ACK number of a received TCP packet is greater than the sequence number of the next TCP packet sending out, it is an invalid ACK.

The allow keyword allows packets with an invalid ACK.

(Default) The drop keyword drops packets with an invalid ACK.

Note TCP packets with an invalid ACK are automatically allowed for WAAS connections.

queue-limit pkt_num [ timeout seconds ]

Sets the maximum number of out-of-order packets that can be buffered and put in order for a TCP connection, between 1 and 250 packets. The default is 0, which means this setting is disabled and the default system queue limit is used depending on the type of traffic:

• Connections for application inspection (the inspect command), IPS (the ips command), and TCP check-retransmission (the TCP map check-retransmission command) have a queue limit of 3 packets. If the ASA receives a TCP packet with a different window size, then the queue limit is dynamically changed to match the advertised setting.
• For other TCP connections, out-of-order packets are passed through untouched.

If you set the queue-limit command to be 1 or above, then the number of out-of-order packets allowed for all TCP traffic matches this setting. For example, for application inspection, IPS, and TCP check-retransmission traffic, any advertised settings from TCP packets are ignored in favor of the queue-limit setting. For other TCP traffic, out-of-order packets are now buffered and put in order instead of passed through untouched.

The timeout seconds argument sets the maximum amount of time that out-of-order packets can remain in the buffer, between 1 and 20 seconds; if they are not put in order and passed on within the timeout period, then they are dropped. The default is 4 seconds. You cannot change the timeout for any traffic if the pkt_num argument is set to 0; you need to set the limit to be 1 or above for the timeout keyword to take effect.

reserved-bits { allow | clear | drop }

Sets the action for reserved bits in the TCP header.

(Default) The allow keyword allows packets with the reserved bits in the TCP header.

The clear keyword clears the reserved bits in the TCP header and allows the packet.

The drop keyword drops the packet with the reserved bits in the TCP header.

seq-past-window { allow | drop }

Sets the action for packets that have past-window sequence numbers, namely the sequence number of a received TCP packet is greater than the right edge of the TCP receiving window.

The allow keyword allows packets that have past-window sequence numbers. This action is only allowed if the queue-limit command is set to 0 (disabled).

(Default) The drop keyword drops packets that have past-window sequence numbers.

synack-data { allow | drop }

Sets the action for TCP SYNACK packets that contain data.

The allow keyword allows TCP SYNACK packets that contain data.

(Default) The drop keyword drops TCP SYNACK packets that contain data.

syn-data { allow | drop }

Sets the action for SYN packets with data.

(Default) The allow keyword allows SYN packets with data.

The drop keyword drops SYN packets with data.

tcp-options { selective-ack | timestamp | window-scale } { allow | clear }

Or

tcp-options range lower upper { allow | clear | drop }

Sets the action for packets with TCP options, including the selective-ack, timestamp, or window-scale TCP options.

(Default) The allow keyword allows packets with the specified option.

(Default for range) The clear keyword clears the option and allows the packet.

The drop keyword drops the packet with the specified option.

The selective-ack keyword sets the action for the SACK option.

The timestamp keyword sets the action for the timestamp option. Clearing the timestamp option disables PAWS and RTT.

The widow-scale keyword sets the action for the window scale mechanism option.

The range keyword specifies a range of options. The lower argument sets the lower end of the range as 6, 7, or 9 through 255.

The upper argument sets the upper end of the range as 6, 7, or 9 through 255.

ttl-evasion-protection

Enables the TTL evasion protection. Do not disable this command it you want to prevent attacks that attempt to evade security policy.

For example, an attacker can send a packet that passes policy with a very short TTL. When the TTL goes to zero, a router between the ASA and the endpoint drops the packet. It is at this point that the attacker can send a malicious packet with a long TTL that appears to the ASA to be a retransmission and is passed. To the endpoint host, however, it is the first packet that has been received by the attacker. In this case, an attacker is able to succeed without security preventing the attack.

urgent-flag { allow | clear }

Sets the action for packets with the URG flag. The URG flag is used to indicate that the packet contains information that is of higher priority than other data within the stream. The TCP RFC is vague about the exact interpretation of the URG flag, therefore end systems handle urgent offsets in different ways, which may make the end system vulnerable to attacks.

The allow keyword allows packets with the URG flag.

(Default) The clear keyword clears the URG flag and allows the packet.

window-variation { allow | drop }

Sets the action for a connection that has changed its window size unexpectedly. The window size mechanism allows TCP to advertise a large window and to subsequently advertise a much smaller window without having accepted too much data. From the TCP specification, “shrinking the window” is strongly discouraged. When this condition is detected, the connection can be dropped.

(Default) The allow keyword allows connections with a window variation.

The drop keyword drops connections with a window variation.

Step 1

class-map name

hostname(config)# class-map bypass_traffic

Creates a class map to identify the traffic for which you want to disable stateful firewall inspection.

Step 2

match parameter

hostname(config-cmap)# match access-list bypass

Specifies the traffic in the class map. See the “Identifying Traffic (Layer 3/4 Class Maps)” section for more information.

Step 3

policy-map name

hostname(config)# policy-map tcp_bypass_policy

Adds or edits a policy map that sets the actions to take with the class map traffic.

Step 4

class name

hostname(config-pmap)# class bypass_traffic

Identifies the class map created in Step 1

Step 5

Do one or more of the following:

set connection {[ conn-max n ] [ embryonic-conn-max n ] [ per-client-embryonic-max n ] [ per-client-max n ] [ random-sequence-number { enable | disable }]}

hostname(config-pmap-c)# set connection conn-max 256 random-sequence-number disable

Sets maximum connection limits or whether TCP sequence randomization is enabled.

The conn-max n argument sets the maximum number of simultaneous TCP and/or UDP connections that are allowed, between 0 and 2000000. The default is 0, which allows unlimited connections.

If two servers are configured to allow simultaneous TCP and/or UDP connections, the connection limit is applied to each configured server separately.

When configured under a class, this argument restricts the maximum number of simultaneous connections that are allowed for the entire class. In this case, one attack host can consume all the connections and leave none of the rest of the hosts matched in the access list under the class.

The embryonic-conn-max n argument sets the maximum number of simultaneous embryonic connections allowed, between 0 and 2000000. The default is 0, which allows unlimited connections.

The per-client-embryonic-max n argument sets the maximum number of simultaneous embryonic connections allowed per client, between 0 and 2000000. The default is 0, which allows unlimited connections.

The per-client-max n argument sets the maximum number of simultaneous connections allowed per client, between 0 and 2000000. The default is 0, which allows unlimited connections. When configured under a class, this argument restricts the maximum number of simultaneous connections that are allowed for each host that is matched through an access list under the class.

The random-sequence-number { enable | disable } keyword enables or disables TCP sequence number randomization. See the “TCP Sequence Randomization” section section for more information.

You can enter this command all on one line (in any order), or you can enter each attribute as a separate command. The ASA combines the command into one line in the running configuration.

Note For management traffic, you can only set the conn-max and embryonic-conn-max keywords.

set connection timeout {[ embryonic hh : mm : ss] { idle hh : mm : ss [ reset ]] [ half-closed hh : mm : ss] [dcd hh : mm : ss [ max_retries ]]}

hostname(config-pmap-c)# set connection timeout idle 2:0:0 embryonic 0:40:0 half-closed 0:20:0 dcd

Sets connection timeouts.

The embryonic hh : mm : ss keyword sets the timeout period until a TCP embryonic (half-open) connection is closed, between 0:0:5 and 1193:0:0. The default is 0:0:30. You can also set this value to 0, which means the connection never times out.

The idle hh : mm : ss keyword sets the idle timeout for all protocols between 0:0:1 and 1193:0:0. The default is 1:0:0. You can also set this value to 0, which means the connection never times out. For TCP traffic, the reset keyword sends a reset to TCP endpoints when the connection times out.

The half-closed hh : mm : ss keyword sets the idle timeout between 0:5:0 and 1193:0:0. The default is 0:10:0. Half-closed connections are not affected by DCD. Also, the ASA does not send a reset when taking down half-closed connections.

The dcd keyword enables DCD. DCD detects a dead connection and allows it to expire, without expiring connections that can still handle traffic. You configure DCD when you want idle, but valid connections to persist. After a TCP connection times out, the ASA sends DCD probes to the end hosts to determine the validity of the connection. If one of the end hosts fails to respond after the maximum retries are exhausted, the ASA frees the connection. If both end hosts respond that the connection is valid, the ASA updates the activity timeout to the current time and reschedules the idle timeout accordingly. The retry-interval sets the time duration in hh : mm : ss format to wait after each unresponsive DCD probe before sending another probe, between 0:0:1 and 24:0:0. The default is 0:0:15. The max-retries sets the number of consecutive failed retries for DCD before declaring the connection as dead. The minimum value is 1 and the maximum value is 255. The default is 5.

The default tcp idle timeout is 1 hour.

The default udp idle timeout is 2 minutes.

The default icmp idle timeout is 2 seconds.

The default esp and ha idle timeout is 30 seconds.

For all other protocols, the default idle timeout is 2 minutes.

To never time out, enter 0:0:0.

You can enter this command all on one line (in any order), or you can enter each attribute as a separate command. The command is combined onto one line in the running configuration.

Note This command is not available for management traffic.

set connection advanced-options tcp-map-name

hostname(config-pmap-c)# set connection advanced-options tcp_map1

Customizes the TCP normalizer. See the “Customizing the TCP Normalizer with a TCP Map” section to create a TCP map.

set connection advanced-options tcp-state-bypass

hostname(config-pmap-c)# set connection advanced-options tcp-state-bypass

Enables TCP state bypass.

Step 6

service-policy policymap_name {global | interface interface_name }

hostname(config)# service-policy tcp_bypass_policy outside

Activates the policy map on one or more interfaces. global applies the policy map to all interfaces, and interface applies the policy to one interface. Only one global policy is allowed. You can override the global policy on an interface by applying a service policy to that interface. You can only apply one policy map to each interface.

If you use the show conn command, the display for connections that use TCP state bypass includes the flag “b.”