Access List on ASA5505

Steven Couture — Tue, 26 Mar 2019 00:53:45 GMT

Here is a current access list on an ASA that I mange:

access-list outside_access_in_1 extended permit tcp any host 192.168.0.81 eq 7500
access-list outside_access_in_1 extended permit object RDP any object FileServer
access-list outside_access_in_1 extended permit tcp any host 192.168.0.81 eq 53827
access-list outside_access_in_1 extended permit tcp any object New_Server eq 3389
access-list outside_access_in_1 extended permit tcp any host 192.168.0.81 eq 53828
access-list outside_access_in_1 extended permit tcp any host 192.168.0.81 eq 53829
access-list outside_access_in_1 extended permit tcp any host 192.168.0.81 eq 53830
access-list outside_access_in_1 extended permit tcp any object New_Server eq 53850
access-list outside_access_in_1 extended permit tcp any object New_Server eq 53810
access-list outside_access_in_1 extended permit tcp any object New_Server eq 53855
access-list outside_access_in_1 extended permit tcp any object New_Server eq telnet
access-list outside_access_in_1 extended permit tcp any object New_Server eq 55443
access-list outside_access_in_1 extended permit tcp any object New_Server eq 7500
access-list outside_access_in_1 extended permit tcp any object DattoDevice eq ssh
access-list outside_access_in_1 extended permit udp any object DattoDevice eq ntp
access-list outside_access_in_1 extended permit icmp any object DattoDevice

I have highlighted the last three statements - are these correct?

If you want to allow SSH/NTP

Karsten Iwen — Sun, 31 Aug 2014 17:30:14 GMT

If you want to allow SSH/NTP and ICMP to DattoDevice, then these ACEs are correct.

Thank you.....can you tell me

Steven Couture — Sun, 31 Aug 2014 21:12:09 GMT

Thank you.....can you tell me how to test these using packet tracer in the ASDM?

packet-tracer input outside

Karsten Iwen — Sun, 31 Aug 2014 21:21:10 GMT

packet-tracer input outside tcp 1.2.3.4 1234 PUBLIC-IP-OF-DATTO-DEVICE 22

"1.2.3.4 1234" is just a random source-ip and port.

Thanks again -

Steven Couture — Sun, 31 Aug 2014 22:15:26 GMT

Thanks again -

topic packet-tracer input outside in Network Security

Access List on ASA5505

If you want to allow SSH/NTP

Thank you.....can you tell me

packet-tracer input outside

Thanks again -