Adding Global Deny Any Rule With Logging

Nathan Hawkins — Tue, 12 Mar 2019 01:10:07 GMT

Is there a simple way to add an explicit Deny Any Any rule (with logging enabled) globally applied to all interfaces (with the assumption it goes to the bottom of the Access-List)?

Adding Global Deny Any Rule With Logging

Jouni Forss — Tue, 05 Mar 2013 15:19:10 GMT

Hi,

ASA has the possibility from 8.3 software level onwards to use "global" ACL that is attached globally for every interfaces ingress direction.

According to Cisco documentation any interface ACL will override the "global" ACL. So I would imagine that you would have to have interface ACL for the ingress direction of each interface and then a "global" ACL with only "deny ip any any" or "deny ip any any log" to which every connection that didnt match interface ACL would "drop" to.

Personally I have never started using "global" ACL. I simply like the interface based ACLs and I have no reason to change. Therefore I would personally use a separate "deny ip any any" at the bottom of every interface ACL. When you add it for the first time it naturally goes to the bottom of each ACL. Adding more rules to the ACL later would require you to add them in between with "line" number parameter.

Maybe I'll do a simple test for this on my home ASA soon to confirm that the operation is as mentioned above.

Heres a quote from Cisco ASA Command Reference

Usage Guidelines for Global Rules

The access-group global command applies a single set of global rules on all traffic, no matter which

interface the traffic arrives at the ASA.

Global rules for the access-group global command support extended access lists only.

All global rules apply only to traffic in the ingress (input) direction. Global rules do not support egress

(output) traffic.

Global rules for access-group global do not support the control-plane nor the per-user-override

options that are supported in interface-specific access rules.

If global rules are configured in conjunction with interface access rules, then the interface access rule,

which is specific, is processed before the global access rule, which is general.

- Jouni

Adding Global Deny Any Rule With Logging

Nathan Hawkins — Fri, 08 Mar 2013 00:51:29 GMT

Ok, I've created said "global" access-list, but how do you apply it globally?

Adding Global Deny Any Rule With Logging

Jouni Forss — Fri, 08 Mar 2013 07:25:59 GMT

Hi,

You use a "access-group" configuration like with the interface ACL

"access-group global"

- Jouni

topic Adding Global Deny Any Rule With Logging in Network Security

Adding Global Deny Any Rule With Logging

Adding Global Deny Any Rule With Logging

Adding Global Deny Any Rule With Logging

Adding Global Deny Any Rule With Logging