topic Basic ASA5505 Setup Question in Network Security

Basic ASA5505 Setup Question

WStoffel1 — Mon, 11 Mar 2019 21:52:00 GMT

I have a new 5505 installed to a pretty small network. I have the outside IP/mask/gateway from the provider, and I can see the other end or that connection as well as ping devices out on the internet from the console.

What's a good rule of thumb for my inside network to access the internet knowing I only need 80 and 443 open? Meaning can someone provide an ACL example that will do just that?

I'm guessing the following may be a little TOO open:

access-list outside_access_in extended permit tcp any eq www any eq www

access-list outside_access_in extended permit tcp any eq https any eq https

Thank you.

Basic ASA5505 Setup Question

cadet alain — Wed, 16 Nov 2011 20:30:23 GMT

Hi,

you want to restrict access from inside to tcp 8O,443 on outside?

Regards.

Alain

Basic ASA5505 Setup Question

WStoffel1 — Wed, 16 Nov 2011 20:57:00 GMT

The only thing I want is 80 and 443 open so I can get to http and https from any workstation on the inside, 172.20.10.0 /24.

Is that the correct way of saying it? Essentially completely locked down except for whatever is necessary.

Thank you.

Basic ASA5505 Setup Question

cadet alain — Wed, 16 Nov 2011 21:12:46 GMT

Hi,

ok I understood but you also need to permit DNS and ICMP.

For ICMP just enable inspection like this:

policy-map global_policy

class inspection_default

inspect icmp

For other traffic, you can configure an ACL only permitting return traffic and apply inbound on interface outside or configure an ACL only permitting exiting traffic and apply on interface inside inbound.In this case you'll have to permit icmp if you want it to be inspected.

In latter case your ACL should be like this:

access-list outside_access_out extended permit tcp x.x.x.x.x y.y.y.y any eq www

access-list outside_access_out extended permit tcp x.x.x.x y.y.y.y any eq https

access-list outside_access_out extended permit udp x.x.x.x y.y.y.y any eq dns

access-list outside_access_out extended permit icmp any any

access-group outside_access_out in interface inside

And enable icmp inspection like above.

Regards.

Alain