思科ASA数据包进程算法/Cisco ASA Packet Process Algorithm

这详细是各自的步骤：

1. 数据包被到达在入口接口。

2. 一旦数据包到达接口的内部缓冲器，接口的输入计数器由一个增加。

3. 如果这是当前连接，思科ASA首先查看其内部连接表详细信息为了验证。如果数据包流匹配当前连接，则访问控制表(ACL)检查绕过，并且数据包移动的向前。

   如果数据包流不匹配当前连接，则TCP状态验证。如果它是SYN数据包或UDP (用户数据报协议)数据包，则连接计数器由一个增加，并且数据包为ACL检查发送。如果它不是SYN数据包，数据包丢弃，并且事件被记录。

4. 数据包根据接口ACL处理。它验证顺序按ACL条目的顺序，并且，如果匹配其中任一ACL条目，移动向前。否则，数据包丢弃，并且信息被记录。当数据包匹配ACL条目时， ACL命中数计数由一个增加。

5. 数据包为翻译规则验证。如果数据包穿过此检查，则连接项为此流创建，并且数据包移动向前。否则，数据包丢弃，并且信息被记录。

6. 数据包对检查检查被服从。此检查验证此特定数据包流是否是与协议一致。思科ASA有根据其预定义的套应用程序级功能检查每连接的一内置的检测引擎。如果它通过检查，移动的向前。否则，数据包丢弃，并且信息被记录。

   附加安全性安全性检查将实现，如果内容安全(CSC)模块是包含的。

7. IP报头信息根据网络地址地址转换端口地址转换(NAT/PAT)规则翻译，并且校验和相应地更新。数据包转发到先进的检查和预防安全服务模块(AIP-SSM) IPS涉及的安全性检查的，当AIP模块是包含的时。

8. 数据包转发对根据翻译规则的出口接口。如果出口接口在转换规则没有指定，则目的地接口根据全局路由查找决定。

9. 在出口接口，接口路由查找执行。切记，出口接口取决于采取优先级的转换规则。

10. 一旦找到了第3层路由，并且下一跳识别， Layer2解决方法执行。MAC报头的Layer2重写在此阶段发生。

11. 数据包在电线传送，并且接口计数器在出口接口增加。

Here are the individual steps in detail:

1. The packet is reached at the ingress interface.

2. Once the packet reaches the internal buffer of the interface, the input counter of the interface is incremented by one.

3. Cisco ASA first looks at its internal connection table details in order to verify if this is a current connection. If the packet flow matches a current connection, then the Access Control List (ACL) check is bypassed and the packet is moved forward.

   If packet flow does not match a current connection, then the TCP state is verified. If it is a SYN packet or UDP (User Datagram Protocol) packet, then the connection counter is incremented by one and the packet is sent for an ACL check. If it is not a SYN packet, the packet is dropped and the event is logged.

4. The packet is processed as per the interface ACLs. It is verified in sequential order of the ACL entries and if it matches any of the ACL entries, it moves forward. Otherwise, the packet is dropped and the information is logged. The ACL hit count is incremented by one when the packet matches the ACL entry.

5. The packet is verified for the translation rules. If a packet passes through this check, then a connection entry is created for this flow and the packet moves forward. Otherwise, the packet is dropped and the information is logged.

6. The packet is subjected to an Inspection Check. This inspection verifies whether or not this specific packet flow is in compliance with the protocol. Cisco ASA has a built-in inspection engine that inspects each connection as per its pre-defined set of application-level functionality. If it passed the inspection, it is moved forward. Otherwise, the packet is dropped and the information is logged.

   Additional security checks will be implemented if a Content Security (CSC) module is involved.

7. The IP header information is translated as per the Network Address Translation/ Port Address Translation (NAT/PAT) rule and checksums are updated accordingly. The packet is forwarded to Advanced Inspection and Prevention Security Services Module (AIP-SSM)  for IPS related security checks when the AIP module is involved.

8. The packet is forwarded to the egress interface based on the translation rules. If no egress interface is specified in the translation rule, then the destination interface is decided based on the global route lookup.

9. On the egress interface, the interface route lookup is performed. Remember, the egress interface is determined by the translation rule that takes the priority.

10. Once a Layer 3 route has been found and the next hop identified, Layer 2 resolution is performed. The Layer 2 rewrite of the MAC header happens at this stage.

11. The packet is transmitted on the wire, and interface counters increment on the egress interface.