ASA - What is allowing return HTTP traffic?

Question

Hi,
I'm just playing around with a few ASA's and wondering what allows return HTTP traffic into the firewall? Also, what other traffic is allowed by default like HTTP?
Traffic is originating from a higher security interface (inside, 100) to a lower security interface (outside, 0). There is no ACL's applied on any interfaces.
I'm asking because ICMP doesn't work unless inspection is turned on (service-policy global_policy global).
Thanks for any help.

Answer 1

Firewalls like the ASA are stateful so for TCP and UDP (although with UDP state is handled a little differently) if traffic is allowed one way it is automatically allowed back.
So when a connection is initiated, if it is allowed through the firewall an entry is made in the state table and when the return packet arrives at the firewall if there is a matching entry the traffic is allowed and there is no acl check.
The entry is made on source and destination IP and port numbers, and for TCP it also used the connection flags.
ICMP doesn't use ports so originally it could not be treated statefully and you had to allow it back in with an acl (if traffic was from lower to higher security level).
But then stateful inspection was added for ICMP as well but you still need to enable it unlike TCP and UDP.
Jon