topic Control-plane ACL on Firepower 4110 in Network Security

Control-plane ACL on Firepower 4110

ABaker94985 — Mon, 03 Oct 2022 15:05:43 GMT

We have a 4110 managed by an FMC that we need to configure to block IKE traffic from. That's easy enough to do with a control-plane ACL, but I was looking at this:

https://integratingit.wordpress.com/2021/06/26/ftd-control-plane-acl/

It shows a deny statement followed by as explicit "permit ip any any". Is the permit statement needed? I've always understood the control-planes to having an implicit "permit ip any any". If there is an implicit, I realize the explicit statement won't matter, so it's a matter of satisfying my curiosity. Thanks

Re: Control-plane ACL on Firepower 4110

Sheraz.Salim — Mon, 03 Oct 2022 19:05:10 GMT

Adding the control-plane keyword to the ACL entry, the traffic inspection applies to traffic destined to the ASA. Without the control-plane keyword, the ACL entries will apply to traffic traversing through the ASA.

The control-plane keyword specifies if the ACL is used to control to-the-box traffic. Access control rules for to-the-box management traffic (defined by such commands as http, ssh, or telnet) have higher precedence than a management access rule applied with the control-plane option. Therefore, such permitted management traffic will be allowed to come in even if explicitly denied by the to-the-box ACL.

Unlike regular access rules, there is no implicit deny at the end of a set of management rules for an interface. Instead, any connection that does not match a management access rule is then evaluated by regular access control rules. Alternatively, you can use ICMP rules to control ICMP traffic to the device.

ASA Access Control List Configuration Examples for Various Scenarios - Cisco

Re: Control-plane ACL on Firepower 4110

MHM Cisco World — Mon, 03 Oct 2022 15:20:49 GMT

""For management (control plane) ACLs, which control to-the-box traffic, there is no implicit deny at the end of a set of management rules for an interface. Instead, any connection that does not match a management access rule is then evaluated by regular access control rules.""

from cisco ASA ACL
https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/access-acls.html

Re: Control-plane ACL on Firepower 4110

ABaker94985 — Mon, 03 Oct 2022 17:39:16 GMT

Thank you both for the replies, and I read both links prior to posting. I realize there is normally a default "deny ip any any" at the end of a normal access list, but if I leave the "permit ip any any" off the control-plane ACL, it shouldn't matter, correct, given there is no implicit deny?

Re: Control-plane ACL on Firepower 4110

Sheraz.Salim — Mon, 03 Oct 2022 19:03:29 GMT

There is no implicit deny at the end of control plane ACL.