topic Re: Simplify ACL lists and IPsec in Network Security

Simplify ACL lists and IPsec

Jon Are Endrerud — Fri, 21 Feb 2020 14:25:51 GMT

Hey

I have a large network with a ASA5555-X in middle and about 30-40 ASA's in branch offices.

Maintaing ACL lists on the branch office firewalls are a lot of work. Is it possible in any way to IPsec the wanted subnets and use the the main ACL list on one of the ASA5555X interfaces instead.

F.eks.

client --> IP --> ASA BRANCH--> IPSEC <--- ASA5555X ---> ACL ---> Servers

Thanx

Re: Simplify ACL lists and IPsec

Seb Rupik — Wed, 04 Oct 2017 08:56:44 GMT

Hi there,

Of course you could do that, but it would be wasteful of bandwidth to send traffic accross the WAN only to be dropped at the main office. It is best practice to drop traffic as close to source as possible.

cheers,

Seb.

Re: Simplify ACL lists and IPsec

Kias — Fri, 06 Oct 2017 05:17:14 GMT

Hi,

Yes, you can classify branch office rules and global edge rules on the ASA5555.

The branch office rules will pertain to internet access and the ASA5555 ACL could be for the IPSec traffic originating from the branches.

Regards,

Kias

Re: Simplify ACL lists and IPsec

Jon Are Endrerud — Mon, 16 Oct 2017 11:04:21 GMT

This sounds like a good idea. How do I make the IPsec traffic hit the global edge rules on the 5555X ?

For example I have:

branch subnett ---> 10.16.100.0/22

branch subnett ---> 172.16.124.0/24

branch subnett ---> 10.16.120.0/24

When they have a direct connection, I dont see how I can get everyhing to use one ACL list on the remote 5555X.

Thanx

Re: Simplify ACL lists and IPsec

Kias — Mon, 16 Oct 2017 11:12:29 GMT

Hi,

I assume the following:

HQ --> 1.1.1.1/16

branch 1 subnett ---> 10.16.100.0/22

branch 2 subnett ---> 172.16.124.0/24

branch 3 subnett ---> 10.16.120.0/24

3 Site to site VPNs from HQ to branches will be established. In this scenario, traffic from branch 3 to branch 1 will be routed through HQ as the hop. At HQ the ACL is defined to control the branch 3 -> 1 via ACL. Also NoNat and hair pining are required for the VPN's which I beleive is one time config.

Regards,

Kias