topic The source address is an in Network Security

Firewall interface IP address and Source and Object group network IP address

mahesh18 — Tue, 12 Mar 2019 05:26:38 GMT

Hi Everyone,

Need to confirrm say firewall Interface X has IP 172.24.100.1/24

Now under this interface if i need to make ACL rule do i need to make sure that source address or if i choose source as object-group network

do they have to be in same subnet as X interface IP 172.24.100.1?

Regards

MAhesh

The source address is an

Karsten Iwen — Tue, 03 Feb 2015 17:15:58 GMT

The source address is an address that can enter the ASA on that interface. That can be directly connected like your 172.24.100.0/24 or a remote-network that is connected with a router/L3-switch.

Hi Karsten, So dooes this

mahesh18 — Tue, 03 Feb 2015 17:31:21 GMT

Hi Karsten,

So dooes this mean that if interface IP is 172.24.100.0/24 then i can use for example source address

like 172.24.36.0/24 as long as firewall interface X with IP 172.24.100.0/24 knows how to reach it via

layer 3 switch?

Regards

Mahesh

Yes, here an example:

Karsten Iwen — Tue, 03 Feb 2015 17:43:18 GMT

Yes, here an example:

Internet ------ ASA ------------- L3-Sw ----------- internal Network
                     10.0.1.0/28         10.10.0.0/24

In this scenario the ACL on the inside interface will allow source-addresses in the 10.10.0.0/24 range which is not part of the interface IP. The ASA needs a route to the L3-Switch for the 10.10.0.0/24 network.

Many thanks Karsten learn

mahesh18 — Tue, 03 Feb 2015 18:21:36 GMT

Many thanks Karsten learn something new today.

Best regards

Mahesh