ASA ACL Help

newbiefromfortinet — Thu, 25 Nov 2021 18:00:33 GMT

Hello,

Fairly new to ASA, have done some limited work in the past. Wondering if someone could give me a quick run down on what the following ACL statements do and, following the last statement, is it implicit "deny"?

access-list outside-acl; 4 elements; name hash: 0x9bea1c52

access-list outside-acl line 1 extended permit tcp any interface outside eq 3389

access-list outside-acl line 2 remark Allow pinging of firewall

access-list outside-acl line 3 extended permit icmp any interface outside echo

access-list outside-acl line 4 extended permit icmp any interface outside echo-reply

access-list outside-acl line 5 extended deny ip any any log informational interval 300

access-list dmz-acl; 4 elements; name hash: 0x282e44f8

access-list dmz-acl line 1 extended permit udp any any eq ntp

access-list dmz-acl line 2 extended permit ip any host 10.74.0.27

access-list dmz-acl line 3 extended permit ip host 172.22.12.16 any log informational interval 300

access-list dmz-acl line 4 remark 'allow backup'

access-list dmz-acl line 5 extended permit ip any host 10.101.0.160

access-list nat-acl; 1 elements; name hash: 0xf4b526c2

access-list nat-acl line 1 extended permit ip 172.22.0.0 255.255.0.0 any

Any help is appreciated!

Re: ASA ACL Help

BmfL — Thu, 25 Nov 2021 18:58:16 GMT

Those ACLs are permitting and denying IPs, protocols, etc…, for example:

access-list outside-acl line 1 extended permit tcp any interface outside eq 3389:

Permits tcp from any interface to outside. That applies when equals to port 3389 which used for Microsoft WBT Server, used for Windows Remote Desktop and Remote Assistance connections (RDP - Remote Desktop Protocol).

ASA has an implicit deny.

I would read the following documentation for better understanding:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/access-acls.html#ID-2069-0000011a

https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html?referring_site=RE&pos=3&page=https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/access-acls.html

In addition, if you have some spare time you can read this book which not only will teach about ACLs but ASA overall:

https://www.ciscopress.com/store/cisco-asa-all-in-one-next-generation-firewall-ips-and-9781587143076

topic Re: ASA ACL Help in Network Security

ASA ACL Help

Re: ASA ACL Help