topic please help me configure TFTP access-list on ASA for device management in Network Security

please help me configure TFTP access-list on ASA for device management

suruchigupta555 — Fri, 13 Sep 2024 13:26:54 GMT

I need help configuring a TFTP server access list to prevent attackers who acquire SNMP write privileges for obtaining device configuration information.

I have SNMP access list configured already. So it is not a problem. But I need to deal with TFTP.

1. Please guide me how to configure TFTP access-list on ASA for device management purpose. (not passing traffic)

2. I believe that ASA has only TFTP client function, not server. Is TFTP server functioning by default? If yes, how can I disable it?

I am using FPR2110, I'm bit new on this technology please help

Re: please help me configure TFTP access-list on ASA for device manage

MHM Cisco World — Fri, 13 Sep 2024 14:35:57 GMT

control-plane ACL

access-list TFTP deny tcp any any eq 69

direction IN

this make ASA can connect to server but deny any attempt to connect tftp using tcp port 69

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221457-configure-control-plane-access-control-p.html

MHM

Re: please help me configure TFTP access-list on ASA for device manage

Aref Alsouqi — Fri, 13 Sep 2024 15:56:23 GMT

Cisco ASA does not support TFTP server functionality, it can only act as a TFTP client, so I can't see the concern of having someone trying to connect to the ASA and download any data from it. If someone tries the ASA won't respond to the TFTP request as it doesn't have TFTP server capabilities.

A better general recommendation with SNMP would be to use SNMPv3 with both authentication and encryption rather than using v2.