topic Re: ACL logic, please confirm. in Network Security

ACL logic, please confirm.

MicJameson1 — Tue, 24 Jan 2023 13:43:23 GMT

ACL logic, please confirm.

On an ASA 5525...

"access-list inside_in extended permit tcp host 172.16.0.2 host 1.1.1.1 eq 2222"

Is the following a true statement?... "Host 172.16.0.2 using source port 5678 and destination port 2222 will be able to send, and during this same session receive, sftp traffic to and from remote host 1.1.1.1 ."

Thank you.

Re: ACL logic, please confirm.

ahollifield — Tue, 24 Jan 2023 14:25:21 GMT

This probably belongs here: https://community.cisco.com/t5/network-security/bd-p/discussions-network-security

But yes; source = 172.16.0.2, destination = 1.1.1.1, destination port = TCP/2222, permit

Re: ACL logic, please confirm.

Rob Ingram — Tue, 24 Jan 2023 15:14:32 GMT

@MicJameson1 yes and assuming the correct direction and interface is configured - "access-group inside_in in interface inside"

Re: ACL logic, please confirm.

MicJameson1 — Tue, 24 Jan 2023 15:56:11 GMT

I only ask the basic below question because ASAs differ from other Cisco devices, and also the below config already exists in this active production ASA 5525...

"access-list inside_in extended permit ip any any
access-list inside_in extended permit tcp host 172.16.1.5 any eq 2222
access-list inside_in extended permit tcp host 172.16.1.5 any eq ssh
access-list inside_in extended permit tcp host 172.16.1.6 any eq ssh
access-list inside_in extended deny tcp any any eq ssh
access-list inside_in extended permit ip host 172.16.1.5 any"

Doesn't the line "access-list inside_in extended permit ip any any" make irrelevant the five lines below it?

Thank you.

Re: ACL logic, please confirm.

Rob Ingram — Tue, 24 Jan 2023 16:04:41 GMT

Yes, all traffic from inside would match the first rule and never match the more specific rules below.

Re: ACL logic, please confirm.

MHM Cisco World — Tue, 24 Jan 2023 16:35:50 GMT

to check acl do
show access-list <<- then check the hitcnt,
hitcnt will give fast review if the ACL permit/deny any traffic.

Re: ACL logic, please confirm.

MicJameson1 — Tue, 24 Jan 2023 18:00:37 GMT

Hi Rob.

May you also please answer these two questions?

1. "access-list inside_in extended deny tcp any any eq domain"-- Does this mean any elements that use tcp with a domain instead of an IP address will be blocked by the ACL?

2. "access-list inside_in extended deny tcp any any range 137 netbios-ssn"-- What does "range 137 netbios-ssn" mean?

Thank you.

Re: ACL logic, please confirm.

Rob Ingram — Tue, 24 Jan 2023 18:09:24 GMT

@MicJameson1 no, "domain" is the name for DNS over TCP on port 53. So that rule is denying an traffic on tcp/53.

"netbios-ssn" is udp/139 - so essentially thats a range of 137-139