topic Applying ACL on outside interface of ASA in Network Security

Applying ACL on outside interface of ASA

mahesh18 — Tue, 12 Mar 2019 02:06:46 GMT

Hi Everyone,

Say we have ASA with many interfaces.

Users are on interface x .

Interface x has ACL that allows access to certain IP address only and it has deny ip any any at the end.

Now user needs access to some website on specfic port only.

If i make ACL on outside interface of ASA allowing access to that website on specfic port direction outwards from source any it should work right ?

Regards

Mahesh

Applying ACL on outside interface of ASA

Julio Carvajal — Wed, 03 Jul 2013 21:23:19 GMT

Hello,

It should,

make sure the Permit statement is before the deny one

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

Applying ACL on outside interface of ASA

Jouni Forss — Wed, 03 Jul 2013 21:29:10 GMT

Hi Mahesh,

Generally you allow and/or restrict user traffic in the interface ACL closest to the user. In your case it would be interface X's ACL.

When the user attempts the connection to the site, the first thing that will be checked is the interface X ACL if there is one that is attached to the "in" direction.

So I would imagine that there is no need to configure a new ACL for this purpose. Just use the existing ACL on the interface X to allow what traffic you need since it will be the first one checked and there isnt really need to do it twice.

- Jouni

Applying ACL on outside interface of ASA

mahesh18 — Thu, 04 Jul 2013 17:26:33 GMT

Hi Jouni,

I agreee what you say as extended ACL are applied close to source.

But current design here allows outbound interface as traffic leaves the ASA to allow certain websites .

Regards

Mahesh