topic Re: Basic ASA ACL Question in Network Security

Basic ASA ACL Question

newtwork1 — Mon, 11 Mar 2019 20:01:31 GMT

I understand that all traffic from the inside int to the outside int is allowed by default (if the security level of the inside interface is higher than the outside interface). Does that rule apply bi-directionally or do I need to create a rule that will allow all return traffic originating from the inside interface to the outside back IN through an ACE applied to the ouside interface?

Newt.

Re: Basic ASA ACL Question

Jennifer Halim — Sun, 06 Mar 2011 06:09:18 GMT

The return traffic for traffic originated from inside towards outside is allowed automatically, ie: you do not need to configure ACL to allow the return traffic on the outside interface. ASA keeps tracks of all the connections hence only the first connection needs to be allowed with an ACL if you have applied an ACL on the interface.

Hope that helps.

Re: Basic ASA ACL Question

newtwork1 — Tue, 08 Mar 2011 23:26:08 GMT

Jen,

Thanks for the response. Could you clarify what you mean by "only the first connection needs to be allowed with an ACL if you have applied an ACL on the interface."?

My assumption is you are refering to traffic moving from the outside interface in.

So if an acl is applied to the outside interface permitting traffic to an inside interface the acl will allow the connection, then all subsequent packets matching the rule will be cef switched?

Newt