Configuring Traffic Policing on Cisco ASA Post-9.7: A Modern Approach

🚦 Cisco ASA Traffic Policing Post-9.7 – Complete Educational Guide

📚 Table of Contents

• Introduction
• Policing vs Shaping
• Bandwidth Logic Explained
• Why ASA 9.7+ is Better
• Configuration Steps
• CLI Examples
• Verification
• Best Practices
• Key Takeaways
• Related Articles

📖 Introduction

Traffic management is critical in modern networks where multiple applications compete for bandwidth. Without control, high-bandwidth applications can degrade performance for critical services.

💡 Core Idea: Traffic policing enforces strict limits by dropping excess packets instantly.

⚖️ Policing vs Shaping

Traffic Shaping

Shaping delays packets and smooths traffic flow. It buffers data before sending it.

Traffic Policing

Policing enforces a hard limit. Excess traffic is dropped immediately.

🔽 Expand: Real-world analogy

Shaping = traffic signal controlling flow Policing = strict gate that blocks extra vehicles

📊 Bandwidth Logic Explained

Example policing rule:

police output 1000000

This means 1,000,000 bits per second (1 Mbps).

If incoming rate exceeds this:

• Conforming packets → allowed
• Exceeding packets → dropped

💡 Important: Policing does not queue packets — it drops them instantly.

🚀 Why ASA 9.7+ is Better

• Granular class-based control
• Hierarchical policing
• QoS integration

🔽 Expand: What is Hierarchical Policing?

It allows nested policies. You can control traffic globally and within specific classes simultaneously.

⚙️ Configuration Steps

Step 1: Create Access List

access-list HTTP_TRAFFIC_ACL extended permit tcp any any eq 80

Step 2: Create Class Map

class-map HTTP_TRAFFIC_CLASS
 match access-list HTTP_TRAFFIC_ACL

Step 3: Create Policy Map

policy-map POLICE_HTTP_POLICY
 class HTTP_TRAFFIC_CLASS
  police output 1000000 conform-action transmit exceed-action drop

Step 4: Apply Policy

service-policy POLICE_HTTP_POLICY interface outside

💻 CLI Output Example

ASA# show service-policy interface outside

Class-map: HTTP_TRAFFIC_CLASS
  Packets transmitted: 102345
  Packets dropped: 2345
  Current rate: 950000 bps

🔽 Expand CLI Explanation

This output shows how much traffic passed and how much was dropped due to policing.

🔍 Verification Commands

show service-policy interface outside

🧠 Best Practices

• Use policing carefully with UDP traffic
• Avoid aggressive limits on VoIP/video
• Monitor regularly
• Apply hierarchical policies for large networks

🔽 Expand: TCP vs UDP behavior

TCP adapts to packet loss. UDP does not — leading to potential quality issues.

🎯 Key Takeaways

• Policing enforces strict bandwidth limits
• ASA 9.7 introduces better control
• Hierarchical QoS improves flexibility
• Monitoring is essential

📘 Final Thoughts

Traffic policing is a powerful tool when used correctly. With ASA 9.7+, network administrators gain precise control over bandwidth, enabling better performance and fairness across applications.

Advanced Fragmentation Control in Cisco ASA Post-9.7: A Comprehensive Guide

Cisco ASA Fragmented Packet Handling Post 9.7 Complete Guide

Fragmented packet handling is one of the most critical areas of firewall security. In enterprise environments, firewalls must inspect, filter, and process packets efficiently while protecting networks from malicious traffic patterns. Cisco Adaptive Security Appliance (ASA) devices have evolved significantly in the way they handle fragmented traffic, especially after ASA version 9.7.

This guide explains fragmentation, packet reassembly, fragment chain limits, Flexible Packet Matching (FPM), Modular Policy Framework (MPF), DoS mitigation, packet inspection, logging, monitoring, and advanced best practices for securing fragmented traffic.

💡 Key Takeaways

• Fragmentation occurs when packets exceed MTU limits.
• Older ASA versions relied heavily on fragment chain limits.
• ASA 9.7 introduced smarter fragmentation inspection.
• Flexible Packet Matching improves granular security.
• MPF enables customized policies for fragmented packets.
• Rate-limiting helps mitigate fragmentation-based DoS attacks.
• Modern ASA versions provide better monitoring and logging.

---

Table of Contents

• 1. Introduction to Packet Fragmentation
• 2. MTU and Fragmentation Basics
• 3. Pre-9.7 ASA Fragmentation Handling
• 4. Problems with Legacy Fragment Policies
• 5. ASA Post-9.7 Improvements
• 6. Flexible Packet Matching (FPM)
• 7. Modular Policy Framework (MPF)
• 8. DoS Protection Techniques
• 9. Logging and Monitoring
• 10. Mathematical Analysis of Fragmentation
• 11. Security Best Practices
• 12. CLI Examples and Outputs
• 13. Conclusion

---

1. Introduction to Packet Fragmentation

Packet fragmentation occurs when a device must send data through a network path where the packet size exceeds the Maximum Transmission Unit (MTU). Instead of dropping the packet entirely, the packet is divided into smaller fragments.

Each fragment contains:

• Part of the original payload
• Fragment offset information
• Identification fields
• Reassembly metadata

The destination device reassembles all fragments into the original packet.

Simple Fragmentation Formula

$$ Number\ of\ Fragments = \frac{Packet\ Size}{MTU} $$

Example:

• Packet Size = 4500 bytes
• MTU = 1500 bytes

$$ \frac{4500}{1500} = 3 $$

Therefore:

$$ 3\ Fragments $$

are created.

---

2. Understanding MTU and Fragmentation

MTU stands for Maximum Transmission Unit. It defines the largest packet size a network interface can transmit without fragmentation.

Network Type	Common MTU
Ethernet	1500 bytes
Jumbo Frames	9000 bytes
VPN Tunnel	1400–1460 bytes
PPPoE	1492 bytes

Why Fragmentation Happens

• Different network technologies use different MTUs.
• VPN encapsulation adds overhead.
• Tunneling protocols reduce available payload size.
• Legacy systems may support smaller packet sizes.

Fragmentation Overhead Formula

$$ Overhead = FragmentHeaders \times NumberOfFragments $$

More fragments increase overhead and CPU usage.

---

3. Pre-9.7 ASA Fragmentation Handling

Before ASA 9.7, Cisco ASA handled fragmentation primarily using:

• Fragment chain limits
• Reassembly buffers
• Timeout values

Traditional Configuration

fragment chain 1
fragment size 200

Setting:

$$ fragment\ chain = 1 $$

essentially blocked fragmented traffic entirely.

How It Worked

ASA would only accept:

$$ Fragments \leq 1 $$

Meaning:

• Normal packets passed
• Fragmented packets failed

Benefits

• Reduced fragmentation attacks
• Simplified security model
• Lower memory usage

Disadvantages

• Legitimate fragmented traffic dropped
• VPN applications could fail
• VoIP fragmentation issues
• Large packet applications disrupted

---

4. Problems with Legacy Fragment Policies

The old approach was highly restrictive.

Network traffic today is significantly more dynamic and complex than when earlier ASA versions were designed.

Fragmentation Attack Vectors

• Teardrop attacks
• Overlapping fragments
• Fragment flooding
• Evasion techniques
• Reassembly exhaustion attacks

Memory Consumption Formula

$$ MemoryUsage = Fragments \times FragmentBufferSize $$

Attackers could intentionally increase:

$$ Fragments \uparrow $$

causing:

$$ MemoryUsage \uparrow $$

This could exhaust firewall resources.

---

5. ASA Post-9.7 Improvements

Cisco introduced major enhancements after ASA 9.7.

Instead of simplistic blocking, ASA evolved toward:

• Adaptive inspection
• Granular policy enforcement
• Intelligent reassembly
• Traffic classification
• Rate limiting
• Threat-aware processing

🎯 Major Architectural Change

ASA moved from static fragmentation control to dynamic packet inspection and classification.

---

6. Flexible Packet Matching (FPM)

Flexible Packet Matching (FPM) allows administrators to define advanced matching logic for packets.

FPM Advantages

• Deep inspection capabilities
• Granular packet matching
• Protocol-aware filtering
• Custom security logic

Conceptual Formula

$$ TrafficClassification = PacketAttributes + InspectionRules $$

Instead of blindly accepting or dropping fragments, ASA analyzes:

• Packet type
• Fragment characteristics
• Traffic behavior
• Rate patterns
• Session context

---

7. Modular Policy Framework (MPF)

MPF allows administrators to create detailed security policies.

Basic Fragment Drop Policy

class-map FRAGMENTS
 match packet fragmentation
!
policy-map global_policy
 class FRAGMENTS
  drop
!
service-policy global_policy global

Configuration Explanation

Command	Purpose
class-map	Defines traffic classification
match packet fragmentation	Matches fragmented packets
policy-map	Defines actions
drop	Drops matching packets
service-policy	Applies policy globally

Policy Logic Mathematics

$$ If(FragmentedPacket = True) $$

Then:

$$ Action = Drop $$

---

Selective Fragment Handling

Modern ASA allows selective treatment instead of total rejection.

Adjusted Fragment Chain

fragment chain 10
fragment reassembly-timeout 10

Meaning

• Maximum 10 fragments allowed
• 10-second reassembly timeout

Timeout Formula

$$ Timeout = t_{arrival} - t_{initial} $$

If:

$$ Timeout > ConfiguredLimit $$

Fragments are discarded.

---

8. DoS Protection Using Fragment Controls

Fragmentation attacks are common in DoS scenarios.

Attack Goal

• Consume firewall memory
• Overload CPU
• Exhaust reassembly buffers
• Trigger packet handling delays

Rate-Limiting Example

class-map FRAGMENTS
 match packet fragmentation
!
policy-map LIMIT_FRAGMENTS
 class FRAGMENTS
  police input 100 kbps
!
service-policy LIMIT_FRAGMENTS interface outside

Rate Limiting Formula

$$ TrafficRate \leq AllowedThreshold $$

If:

$$ TrafficRate > Threshold $$

Packets are dropped or delayed.

Benefits

• Prevents fragment flooding
• Preserves firewall performance
• Allows legitimate traffic
• Improves resilience

---

9. Logging and Monitoring

Modern ASA versions improve visibility into fragmented traffic.

Logging Configuration

logging enable
logging trap warnings
logging message 106023

Purpose

• Track dropped fragments
• Identify attack patterns
• Monitor suspicious traffic
• Support forensic analysis

CLI Output Example

ASA-4-106023: Deny protocol fragment src outside:
192.168.1.10 dst inside:10.1.1.5

Monitoring Equation

$$ Visibility = Logs + Alerts + Metrics $$

---

10. Mathematical Analysis of Fragmentation

Fragmentation significantly affects performance mathematically.

Packet Efficiency Formula

$$ Efficiency = \frac{Payload}{Payload + Overhead} $$

As fragmentation increases:

$$ Overhead \uparrow $$

Therefore:

$$ Efficiency \downarrow $$

Fragmentation Delay Formula

$$ TotalDelay = Transmission + Reassembly + Inspection $$

Each fragment adds:

• Processing time
• Memory operations
• Inspection overhead

DoS Amplification Formula

$$ AttackImpact = Fragments \times ProcessingCost $$

Attackers exploit this multiplication effect.

---

11. Security Best Practices

Recommended Practices

• Avoid setting fragment chain too low unnecessarily
• Use MPF for selective inspection
• Implement rate-limiting
• Monitor logs continuously
• Tune timeout values carefully
• Enable threat detection features

Best Practice Philosophy

Modern security is not about blocking everything.

Instead:

$$ Security = Protection + Functionality $$

An overly restrictive firewall can become operationally harmful.

---

12. CLI Examples and Outputs

Viewing Fragment Statistics

show fragment

CLI Output

Fragment chains current  : 12
Fragment chains created  : 2401
Fragment chains expired  : 85
Fragment chains dropped  : 11

Viewing Policy Maps

show service-policy

CLI Output

Global policy:
  Service-policy: global_policy
    Class-map: FRAGMENTS
      Drop packets

Monitoring Threat Detection

show threat-detection rate

CLI Output

Scanning attacks detected:
Fragment attacks: 25
Rate exceeded: YES

---

13. Conclusion

Fragmented packet handling has evolved dramatically in Cisco ASA after version 9.7. Earlier ASA versions relied heavily on rigid controls such as:

$$ fragment\ chain = 1 $$

While effective for blocking fragmentation attacks, this approach also caused legitimate traffic disruptions.

Modern ASA versions introduce:

• Flexible Packet Matching (FPM)
• Granular MPF policies
• Adaptive inspection
• Rate limiting
• Enhanced logging
• Threat-aware fragmentation handling

This creates a more balanced architecture where security and operational functionality coexist effectively.

🎯 Final Summary

• Fragmentation is necessary in modern networks.
• Older ASA versions handled fragments rigidly.
• ASA 9.7 introduced flexible packet handling.
• MPF enables advanced fragment inspection policies.
• Rate limiting protects against fragment floods.
• Logging improves visibility and incident response.
• Modern ASA security focuses on adaptive protection.

Managing ICMP Traffic on Cisco ASA Post-9.7 Without Using ACLs

Managing ICMP Traffic on Cisco ASA Without ACLs

📚 Table of Contents

• Introduction
• Problem Breakdown
• Core Concepts
• Inside → Outside/DMZ
• Outside → DMZ
• MPF Deep Dive
• CLI Configuration
• CLI Output
• Why Not ACLs
• Key Takeaways
• Related Articles

📖 Introduction

Managing ICMP (ping) traffic across firewall zones is a critical task in network security. Traditionally, administrators relied heavily on ACLs to define traffic permissions. However, modern Cisco ASA versions (9.7+) introduce a more flexible and scalable approach using the Modular Policy Framework (MPF).

💡 Key Insight: MPF allows dynamic inspection-based control instead of static rule-based filtering.

🔍 Problem Breakdown

• Allow ICMP from Inside → Outside & DMZ
• Allow ICMP from Outside → DMZ
• Block ICMP from Outside → Inside

🔽 Expand: Why this is challenging

ASA uses security levels. Traffic from low to high security is denied unless explicitly allowed.

🧠 Core Concepts Explained

Security Levels

Each interface has a level (0–100). Higher → lower traffic is allowed by default.

ICMP Inspection

Allows return traffic dynamically without ACLs.

MPF (Modular Policy Framework)

A flexible system for traffic inspection and control.

➡️ Allow ICMP: Inside → Outside & DMZ

Concept

Inside has higher security, so outbound ICMP is allowed. Inspection ensures return traffic works.

Configuration

policy-map global_policy
 class inspection_default
  inspect icmp

🔽 Expand Explanation

This enables stateful ICMP tracking. Replies are automatically permitted.

🌐 Allow ICMP: Outside → DMZ (Without ACL)

Challenge

Traffic from lower to higher security is blocked by default.

Solution Strategy

• Use MPF inspection
• Use NAT exemption
• Avoid changing security levels

⚙️ MPF Deep Dive

MPF works in three layers:

1. Class Map → Identify traffic
2. Policy Map → Define action
3. Service Policy → Apply to interface

💻 CLI Configuration (Step-by-Step)

1. NAT Exemption

object network DMZ-NETWORK
 subnet 192.168.2.0 255.255.255.0
 nat (DMZ,Outside) static DMZ-NETWORK

2. Class Map

class-map ICMP-TRAFFIC
 match default-inspection-traffic

3. Policy Map

policy-map ICMP-POLICY
 class ICMP-TRAFFIC
  inspect icmp

4. Apply Policy

service-policy ICMP-POLICY interface Outside
service-policy ICMP-POLICY interface DMZ

📟 CLI Output Example

ASA# show service-policy

Global policy:
  Class inspection_default
    Inspect: icmp

Interface Outside:
  Service-policy: ICMP-POLICY
    Inspect: icmp

Ping successful to DMZ host
Ping blocked to Inside host

🔽 Expand Output Analysis

Traffic behaves exactly as required: selective ICMP allowed without ACLs.

❓ Why Not Use ACLs?

ACLs introduce:

• Manual overhead
• Complex rule management
• Higher chance of misconfiguration

MPF provides dynamic, scalable control.

🎯 Key Takeaways

• MPF replaces ACL-heavy designs
• ICMP inspection enables stateful behavior
• NAT exemption allows selective flows
• Security levels remain intact
• Configuration stays clean and scalable

📘 Final Thoughts

Modern ASA configurations favor inspection-based policies over static rules. By leveraging MPF, you gain better control, improved security, and reduced complexity.

Advanced Packet Inspection in Cisco ASA: MPF Policies and SSL Decryption

Cisco ASA Post-9.7 Packet Inspection Deep Dive

📚 Table of Contents

• Introduction
• Packet Inspection Basics
• Key Changes in ASA 9.7+
• Modular Policy Framework (MPF)
• Deep Packet Inspection (DPI)
• SSL Inspection
• Logging & Visibility
• Configuration Examples
• CLI Output Samples
• Feature Comparison Table
• Key Takeaways
• Related Articles

🧠 Introduction

Cisco Adaptive Security Appliance (ASA) is a cornerstone in enterprise cybersecurity. It provides firewalling, VPN termination, intrusion prevention, and most importantly—packet inspection.

Post version 9.7, Cisco introduced major improvements in how traffic inspection is handled, making it more scalable, modular, and application-aware.

💡 Core Idea: Modern ASA inspection is not just about blocking ports—it’s about understanding applications.

🔍 Packet Inspection Basics

Packet inspection ensures that traffic passing through a firewall is validated against security rules. ASA uses a stateful inspection engine, meaning it tracks sessions rather than individual packets.

Before vs After Inspection Model

Feature	Pre-9.7 ASA	Post-9.7 ASA
ACL Dependency	High manual ACL dependency	Reduced manual configuration
Inspection Depth	Basic L3/L4 inspection	Advanced L7 inspection
Policy Model	Rigid	Modular (MPF enhanced)

⚙️ Key Changes in ASA 9.7+

🔽 Simplified Inspection Flow

ASA now automatically handles return traffic more intelligently. Administrators no longer need to create extensive inbound ACLs.

🔽 Expanded Default Inspection Policy

Protocols like HTTP, DNS, SMTP, and ICMP are pre-inspected using global policy.

🔽 Application Awareness

Inspection now focuses on application behavior rather than just ports.

🧩 Modular Policy Framework (MPF)

MPF is the backbone of ASA inspection logic. It defines how traffic is classified and handled.

MPF Structure

1. Class Map → Identify traffic
2. Policy Map → Define action
3. Service Policy → Apply globally or per interface

🔽 MPF Flow Explanation

Traffic enters → matched by class map → processed by policy map → enforced via service policy.

🧪 Deep Packet Inspection (DPI)

DPI enables ASA to inspect payload content—not just headers. This is critical for detecting hidden threats inside legitimate traffic.

What DPI Detects

• Malicious HTTP payloads
• Command injection attempts
• Protocol anomalies
• Data exfiltration patterns

🔽 Example Use Case

Blocking malicious file downloads hidden in HTTP POST requests.

🔐 SSL Inspection

Encrypted traffic is no longer safe by default. ASA can decrypt and inspect TLS traffic.

Why SSL Inspection Matters

• Most malware uses HTTPS
• Encrypted tunnels hide attacks
• DPI requires decryption

🔽 SSL Flow

Client → ASA decrypts → inspects → re-encrypts → forwards

📊 Logging & Visibility

Post-9.7 ASA provides detailed logging for:

• Dropped packets
• Protocol violations
• Inspection hits
• Session tracking

⚙️ Configuration Example

Step 1: Class Map

class-map inspection_http
 match port tcp eq 80

Step 2: Policy Map

policy-map type inspect http http_policy
 parameters
  match request uri regex "malicious_site"
  drop-connection log

Step 3: Apply Policy

service-policy http_policy global

💻 CLI Output Samples

ciscoasa# show service-policy
Global policy:
  Service-policy: http_policy
    Class-map: inspection_http
      Inspect: http
      Drop: malicious_site detected

$ ping 8.8.8.8
Reply received with inspection enabled

📋 Feature Comparison

Feature	Function	Benefit
MPF	Traffic classification	Flexible policy control
DPI	Payload inspection	Detect hidden threats
SSL Inspection	Decrypt traffic	Secure encrypted channels
Logging	Event tracking	Forensics & monitoring

🎯 Key Takeaways

• ASA 9.7 improves automation of inspection
• MPF enables modular traffic control
• DPI enhances threat detection depth
• SSL inspection is critical for modern attacks
• Logging improves incident response

📘 Final Thoughts

Cisco ASA post-9.7 represents a shift from traditional firewalling to intelligent application-aware security. It is no longer just about blocking traffic—it is about understanding it.