topic Re: Explicit Deny's on a Firewall in Network Security

Explicit Deny's on a Firewall

Joe Bloggs — Tue, 16 Jul 2024 07:33:22 GMT

Is there any security benefit by putting in specific deny's for say known bad hosts

in a firewall rule base when the rule base has an implicit deny all in it?

Re: Explicit Deny's on a Firewall

MHM Cisco World — Tue, 16 Jul 2024 07:54:55 GMT

Just for troubleshooting

You can check hit and log when you add deny

That it

MHM

Re: Explicit Deny's on a Firewall

Rob Ingram — Tue, 16 Jul 2024 09:09:56 GMT

@Joe Bloggs yes there is. The implicit deny rule will only be hit if there is no more specific rule higher up in the the firewall ruleset that permits the traffic. In some circumstances you may wish to block traffic, for example, you have a firewall rule allowing "any" source to a hosted webserver. So you would add a deny rule from known bad hosts above the allow rule to ensure those bad hosts cannot access the webserver.

Re: Explicit Deny's on a Firewall

Joe Bloggs — Wed, 17 Jul 2024 17:10:22 GMT

So just logging then in your opinion?

I can't see any other reason to have specific deny's in above a permit as the implicit deny would kick in.

Re: Explicit Deny's on a Firewall

MHM Cisco World — Wed, 17 Jul 2024 17:14:54 GMT

Above or below?

Below permit before implicit deny use for troubleshoot

Above permit meanly use to deny specific host from subnet' i.e.

We deny host A in subnet 10.0.0.0

Then we permit subnet 10.0.0.0

MHM

Re: Explicit Deny's on a Firewall

Joe Bloggs — Wed, 17 Jul 2024 17:16:38 GMT

So i appreciate if you have some overly permissive rule and you wanted to stop one specific host from hitting that rule putting a deny in above makes sense.

But if you only have specific ip's talking to specific ip's on specific ports is there any point putting an ACE at the top of the rule base dropping/denying traffic from other hosts?

Re: Explicit Deny's on a Firewall

Rob Ingram — Wed, 17 Jul 2024 17:30:59 GMT

@Joe Bloggs as mentioned, you may need to use it in some circumstances. Each environment and firewall ruleset is different, configure the rules to meet your needs.

If you have strict ACE with specific IP addresses/networks communicating, then no, you may not require an explict deny rule above.