topic Re: Cannot create new Rule on ASA - HELP - HELP in Network Security

Cannot create new Rule on ASA - HELP - HELP

Minh Vu — Tue, 12 Mar 2019 00:30:03 GMT

Hello,

I'm trying to configure my Cisco ASA firewall to allow outside access to my new webserver which is hosting inside the company network.

The number 47 & 48 from image below are my new access rules.

From ouside I can ping to it by using name or IP but when I try to access the website using web browser, I got the page can't display. Yes, my web page is working fine when access using internal network.

When I replace the Destination on #35 with #47 (replace TTCHR2Outside with Dealer.Nittotire) then I can access the website from outside OK.

Would anyone please tell me what I did wrong and how to fix it.

Thanks inadvance.

Cannot create new Rule on ASA - HELP - HELP

Jouni Forss — Thu, 29 Nov 2012 16:51:26 GMT

Hi,

Line 39 has a rule that blocks ALL TCP/UDP traffic from "any" to "any"

As you can see, no rule after line 39 has even gotten 1 hitcount.

You need to remove the current line 39 configuration for any of the latter ones to apply.

- Jouni

Cannot create new Rule on ASA - HELP - HELP

Minh Vu — Thu, 29 Nov 2012 16:54:58 GMT

JouniForss,

Thank you for your quick reply.

Can I just move line 47 & 48 up to before 39 without removing 39?

Re: Cannot create new Rule on ASA - HELP - HELP

Jouni Forss — Thu, 29 Nov 2012 16:55:51 GMT

Also,

Remember that every single ACL ends with an "Implicit Deny" (I guess it should show on ASDM side) which basically blocks all the traffic that hasnt matched any previous ACL rule line.

Making a Deny rule in the middle of an ACL only makes sense when you specily a network/host address regarding either the source or destination of the traffic.

"deny ip any any" doesnt make any sense in the middle of an ACL as it makes the lines after that useless.

Re: Cannot create new Rule on ASA - HELP - HELP

Jouni Forss — Thu, 29 Nov 2012 16:58:18 GMT

Hi,

If you want to leave the "deny ip any any" ACL rule there, then yes, you can just move the 2 rules before that "deny" rule and those should work.

- Jouni

Cannot create new Rule on ASA - HELP - HELP

Minh Vu — Thu, 29 Nov 2012 16:58:51 GMT

So, any line below "Deny" will be blocked, right?

Cannot create new Rule on ASA - HELP - HELP

Minh Vu — Thu, 29 Nov 2012 17:00:26 GMT

Thank you very much for your quick answer on this matter, yes, I am able to acces my website from outside now.

Thanks again.