topic Thank you Collin Clark. in Network Security

ASA Firewall

rajeshcv49 — Tue, 12 Mar 2019 07:03:16 GMT

Hi All,

ASA Firewall Packet flow,

source address 10.1.1.1 destnation address 192.168.1.1, In firewall acl entry i allowed icmp for 10.1.1.1 to 192.168.1.1, but in global-policy if i drop the icmp packets. Can ping 10.1.1.1 to 192.168.1.1?

You can configure global

Collin Clark — Mon, 21 Dec 2015 16:45:47 GMT

You can configure global access rules in conjunction with interface access rules, in which case, the specific interface access rules are always processed before the general global access rules.

If a packet is permitted in

Cisco Freak — Mon, 21 Dec 2015 21:35:37 GMT

If a packet is permitted in the specific interface rule, but denied in the global policy, will the packet be permitted or denied?

Hi,

Shivapramod M — Tue, 22 Dec 2015 02:43:27 GMT

Hi,

As Collin said, it always look for the interface access list first and then only it will look for the global.

So ideally the interface access list should allow the traffic if it matches.

Thanks,

Shivapramod M

Thank you Collin Clark.

rajeshcv49 — Tue, 22 Dec 2015 03:23:45 GMT

Thank you Collin Clark.

So anything that is permitted

Cisco Freak — Tue, 22 Dec 2015 18:35:29 GMT

So anything that is permitted in the interface access-list will not be checked against the global policy. Am I right?

Yes, Your right

rajeshcv49 — Wed, 23 Dec 2015 03:52:30 GMT

Yes, Your right