https://community.cisco.com/t5/network-security/asa-access-group-question/m-p/4000813#M30754 Hi,<BR />An ACL applied to an interface is processed before the global ACL.<BR /><BR />Usually I find most organisations don't use a global ACL, just an interface ACLs.<BR /><BR />FYI, a control-plane ACL is applied before an interface ACL, but the control-plane only processes traffic destined to the ASA itself, where as the interface/global ACL processes traffic through the ASA.<BR /><BR />HTH Wed, 18 Dec 2019 18:50:07 GMT Rob Ingram 2019-12-18T18:50:07Z https://community.cisco.com/t5/network-security/asa-access-group-question/m-p/4000795#M30753 <P>If a firewall is configured with a global access-group and an interface in access-group, what the order that access-lists would be processed?</P> Wed, 18 Dec 2019 18:25:41 GMT https://community.cisco.com/t5/network-security/asa-access-group-question/m-p/4000795#M30753 networkadmin411 2019-12-18T18:25:41Z https://community.cisco.com/t5/network-security/asa-access-group-question/m-p/4000813#M30754 Hi,<BR />An ACL applied to an interface is processed before the global ACL.<BR /><BR />Usually I find most organisations don't use a global ACL, just an interface ACLs.<BR /><BR />FYI, a control-plane ACL is applied before an interface ACL, but the control-plane only processes traffic destined to the ASA itself, where as the interface/global ACL processes traffic through the ASA.<BR /><BR />HTH Wed, 18 Dec 2019 18:50:07 GMT https://community.cisco.com/t5/network-security/asa-access-group-question/m-p/4000813#M30754 Rob Ingram 2019-12-18T18:50:07Z https://community.cisco.com/t5/network-security/asa-access-group-question/m-p/4000843#M30755 This matches what I thought. I am in the process of migrating multiple firewalls away from global ACLs and wanted to be sure that I was on the right path. Thank you. Wed, 18 Dec 2019 19:39:49 GMT https://community.cisco.com/t5/network-security/asa-access-group-question/m-p/4000843#M30755 networkadmin411 2019-12-18T19:39:49Z