topic Acess-list in Network Security

Acess-list

prashantrecon — Mon, 11 Mar 2019 21:23:56 GMT

In firewall traffic flows from higher level to lower level by default.

If I apply access-list to deny particular traffic say 10.1.1.0 /24 network should not flow to lower interface level and apply access-list on inside interface.

Is that remaining network traffic say 192.168.1.0 /24 will also be blocked.

Acess-list

Jennifer Halim — Tue, 13 Sep 2011 08:46:28 GMT

When you configure access-list to deny, you will also need to explicitly configure the allow for the remaining of the other networks that you would like to allow, because there is an implicit deny any any at the end of the access-list.

In your scenario, if you just want to block 10.1.1.0/24 network, then you can configure the following:

access-list inside-acl deny ip 10.1.1.0 255.255.255.0 any

access-list inside-acl permit ip any any

OR/ if you want to be more restrictive, you can also configure the following:

access-list inside-acl deny ip 10.1.1.0 255.255.255.0 any

access-list inside-acl permit ip 192.168.1.0 255.255.255.0 any

Acess-list

prashantrecon — Tue, 13 Sep 2011 09:30:43 GMT

Thank you,

So same concept as on routers.

Acess-list

Jennifer Halim — Tue, 13 Sep 2011 10:15:07 GMT

Yes, absolutely correct, same concept as access-list on routers.

Pls kindly mark the post as answered if you have no further question. Thank you.