I never knew you could get tcpdump files from an ASA

I never knew you could get tcpdump-format files from a cisco ASA. Very cool!

The capture process is the same, but then stop the capture with the command "no capture $CAPNAME interface $INTERFACE" instead of "no capture $CAPNAME". Then you can go to the ASA's web site and find the file in "http://$FIREWALL/capture/$CAPNAME/pcap"

Download it and then you're good to open it with tcpdump or wireshark or whatever your packet capture viewer of choice is.

It doesn't look like there's a way to tftp it rather than turning on the ASA's http server for the duration of the download.

Cisco PIX/ASA order of operations for NAT

From this page on cisco.com:

inside-to-outside:

* If IPSec, then check input access list
* Decryption—for Cisco Encryption Technology (CET) or IPSec
* Check input access list
* Check input rate limits
* Input accounting
* Policy routing
* Routing
* Redirect to Web cache
* NAT inside to outside (local to global translation)
* Crypto (check map and mark for encryption)
* Check output access list
* Inspect context-based access control (CBAC)
* TCP intercept
* Encryption

outside-to-inside:

* If IPSec, then check input access list
* Decryption—for CET or IPSec
* Check input access list
* Check input rate limits
* Input accounting
* NAT outside to inside (global to local translation)
* Policy routing
* Routing
* Redirect to Web cache
* Crypto (check map and mark for encryption)
* Check output access list
* Inspect CBAC
* TCP intercept
* Encryption