topic Very simple ACL question in Network Security

Very simple ACL question

billmatthews — Mon, 11 Mar 2019 22:18:39 GMT

I am looking over a config of an old ASA5520. One network has this ACL applied:

access-list acl_dmztest extended permit icmp any any

access-list acl_dmztest extended permit ip any any

access-list acl_dmztest extended permit tcp host 10.10.10.10 host 10.20.20.20 eq http

Isn't that last statement unneccessary? Would there ever be a valid reason for doing it like that? I'm thinking maybe for logging/rule tracking? Anything else?

Thanks

Bill

Very simple ACL question

ajay chauhan — Tue, 24 Jan 2012 14:52:17 GMT

Hi Bill,

There is a simple rule to put ACL on ASA/PIX. Just remember from Lower Security Level to Higher security level implicit deny is there so to allow this communication you will have to configure ACL to allow specific .

From higher to lower is always allowed no rules required untill unless you want to block some traffic.So cofiguring deny would be good option.

Outside default security level is = 0

Inside Default Security level = 100

DMZ can be anything =0 to 100

Hope this help.

Thanks

Ajay

Very simple ACL question

billmatthews — Tue, 24 Jan 2012 15:08:22 GMT

Hi Thanks Ajay,

I understand that. But if line#2 permits ip any, then why would you need line#3 ?

Very simple ACL question

ajay chauhan — Tue, 24 Jan 2012 15:10:03 GMT

If permit any any then 3rd not required.