topic Acl in Network Security

Acl

Ibrahim Jamil — Mon, 11 Mar 2019 20:10:55 GMT

Guys

I m Applying access list in the inside interface of my ASA 5510,so Please check the below if its correct or not,

access-list in_out extended permit tcp 15.5.0.0 255.255.0.0 any eq 80

access-list in_out extended permit tcp 15.5.0.0 255.255.0.0 any eq 443

access-list in_out extended permit tcp 15.5.0.0 255.255.0.0 any eq 25

access-list in_out extended permit tcp 15.5.0.0 255.255.0.0 any eq 23

access-list in_out extended permit tcp 15.5.0.0 255.255.0.0 any eq ftp

Option 2

access-list in_out extended permit ip 15.5.0.0 255.255.0.0 any

access-group in_out in interface inside

Re: Acl

csaxena — Tue, 22 Mar 2011 18:27:50 GMT

Hello Ibrahim,

Both access-lists options stated are perfect as per the configuration is concerened and seem to allow only 15.15.0.0/16 subnets to have access to outside.

Option 1 will only allow inside users(15.15.0.0/8) to reach outside world on HTTP, HTTPS, SMTP, TELNET & FTP, while option 2 will alllow compete TCP & UDP access to users. Please reply back with your requirement to evaluate this further.

Hope this helps.

Regards,
Chirag

P.S.: please mark this thread as resolved if you feel your query is resolved. Do rate helpful posts. Thanks.

Re: Acl

Ibrahim Jamil — Tue, 22 Mar 2011 18:52:27 GMT

what would you prefer?option 1 or option 2 form ur security point of view,i m looking for restricted access

how to make option 1 in one line config

Re: Acl

andamani — Wed, 23 Mar 2011 03:50:53 GMT

Hi,

Option 1 is restricted to the ports mentioned in the ACL.

if you want to use option 1 in one line then option 2 is the way out.

Hope this helps.

Regards,

Anisha

P.S.: please mark this post as answered if you feel your query is resolved. Do rate helpful posts.

Re: Acl

csaxena — Wed, 23 Mar 2011 15:05:56 GMT

Thanks for adding this Anisha.

Ibrahim, I would suggest to use the following as one liner for option 1:

access-list in_out extended permit tcp 15.5.0.0 255.255.0.0 any

This will include all TCP ports and unlike IP, it will not include UDP ports. This will solve our purpose to to open TCP ports 80, 443, 25, 23, 20 & 21.

Hope this helps.

Regards,

Chirag

P.S.: please mark this post as answered if you feel your query is resolved. Do rate helpful posts.