Cisco ASA 5500 disable connection tracking

ciscocisco-asafirewall

I have cisco ASA 5500 firewall and curious can i disable connection tracking for specific rules or protocol.

In short i want to disable connection tracking for UDP traffic. because UDP is connection less, it doesn't have any state like NEW, ESTABLISHED etc.. what is the purpose of tracking them. I want to exclude them from my ASA rules.

UPDATE

I have quick check in ASA and following traffic we are inspecting. if there is no UDP/SIP there then who is filling connection table?

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect icmp

Here is the connection table output, I can see UDP traffic and my SIP port 6050. How can i tell don't track UDP connection?

fw1/act# show conn
366629 in use, 650039 most used
UDP outside 188.16.1.180:48145 inside 63.91.252.112:6065, idle 0:00:00, bytes 784, flags -
UDP outside 93.170.181.204:11862 inside 63.91.252.112:6065, idle 0:00:00, bytes 796, flags -
UDP outside 194.44.127.194:49526 inside 63.91.252.112:6065, idle 0:00:00, bytes 1226, flags -
UDP outside 5.166.44.120:46668 inside 63.91.252.112:6065, idle 0:00:00, bytes 814, flags -

Best Answer

By default, the ASA inspects SIP and many other protocols as you can see listed below.

policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 

To remove unwanted inspection, go into the policy-map and remove the inspect command.

policy-map global_policy
 class inspection_default
  no inspect sip 

Please be aware that this will kill the existing connections so this should be done off hours or during a maintenance window.