| 8.2 |  | The Cisco PIX Security Appliance |
| 8.2.3 |  | Adaptive Security Algorithm (ASA) |

| The heart of the PIX Security Appliance is the Adaptive Security Algorithm (ASA). The ASA maintains the secure perimeters between the networks controlled by the firewall. Because of the ASA, the PIX Security Appliance is less complex and stronger than a packet filtering designed firewall.

The ASA function also randomizes initial TCP sequence numbers, port numbers, and additional TCP flags before completing the connections. The randomizing of the TCP sequence numbers is to minimize the risk of a TCP sequence number attack.

The stateful, connection-oriented ASA design creates session flows based on source and destinations addresses . This function monitors return packets to ensure they are valid. The function also allows one-way or inside-to-outside connections without an explicit configuration for each internal system and application.

Stateful packet filtering is a secure method of analyzing data packets that places extensive information about a data packet into a table. Each time a TCP connection is established for inbound or outbound connections through the PIX Security Appliance, the information about the connection is logged in a stateful session flow table. For a session to be established, information about the connection must match information stored in the table. With this methodology, the stateful filters work on the connections but not the packets. This makes it a more stringent security method, and its sessions have greater immunity to session hijacking.

The ASA also implements the security policy based on interface security levels. The security level designates whether an interface is trusted or untrusted relative to another interface. An interface is considered trusted, or more protected, in relation to another interface if its security level is higher than the security level of the other interface. It is considered untrusted, or less protected, in relation to another interface if its security level is lower than the security level of the other interface.

The primary rule for security levels is that an interface with a higher security level can access an interface with a lower security level. Conversely, an interface with a lower security level cannot access an interface with a higher security level without a conduit or an access control list (ACL), which is discussed later in the module. Finally, interfaces with the same security level cannot pass traffic between interfaces, regardless of configuration.

Security levels range from 0 to 100, and the rollover text in Figure documents the specific rules for these security levels.

The following are examples of different interface connections between the PIX Security Appliance and other perimeter devices:

- More secure interface with a higher security level to a less secure interface with a the lower security level - Traffic originating from the inside interface of the PIX Firewall with a security level of 100 to the outside interface of the PIX Security Appliance with a security level of 0 follows this rule. This rule allows all IP-based traffic unless restricted by ACLs, authentication, or authorization.
- Less secure interface with a lower security level, to a more secure interface with a higher security level - Traffic originating from the outside interface of the PIX Firewall with a security level of 0 to the inside interface of the PIX Security Appliance with a security level of 100 follows this rule. This rule drops all packets unless specifically allowed by the conduit or access list command. The traffic can be further restricted if authentication and authorization are used.
- Equally secure interface to a interface - No traffic flows between two interfaces with the same security level. For example, both interfaces set to level 50.