topic Re: Access-list question in Network Security

Access-list question

Dustin Barnett — Mon, 11 Mar 2019 20:12:50 GMT

I was going through an old PIX firewall config, and correct me if I'm wrong, but doesn't the following open the firewall to anything?

access-list acl_in permit ip any any

Re: Access-list question

andamani — Fri, 25 Mar 2011 17:14:32 GMT

hi,

if you apply it on an outside interface then the answer is 'yes'. it opens the firewall for anything.

Regards,

Anisha

P.S.: please mark this thread as answered if you your query is resolved.Do rate helpful posts.

Re: Access-list question

Dustin Barnett — Fri, 25 Mar 2011 19:16:46 GMT

Ok, that makes sense. This line is showing as quoted when issuing show runningconfig command. This is on a pix 501, version 6.3.

Is it assinged to no interface?

Re: Access-list question

Jon Marshall — Fri, 25 Mar 2011 21:06:23 GMT

barnettd@nulaid.com

Ok, that makes sense. This line is showing as quoted when issuing show runningconfig command. This is on a pix 501, version 6.3.

Is it assinged to no interface?

You need to look for an access-group command with the same access-list name eg. if your access-list was called outside_in then you need to look for a line in your config -

access-group outside_in in <-- where interface is the actual interface it is applied to.

It may well be applied to inside interface although traffic is allowed out by default.

Bear in mind also that simply having this line does not permit all traffic if applied to the outside interface. You also need NAT translations for traffic to be allowed but you should still remove it if it is applied to the outside and replace it with a more restrictive access-list ie. only allow in what you need to.

Jon

Re: Access-list question

Dustin Barnett — Fri, 25 Mar 2011 22:55:32 GMT

Thanks for the adivce. It looks like this access-list is applied to the inside interface.