topic Re: Firewall Rule Interpretation in Network Security

Firewall Rule Interpretation

ksarin123_2 — Mon, 11 Mar 2019 19:36:53 GMT

Hello All,

Can someone please explain this rule configured in a Cisco ASA firewall? Apparently, this rule was written to allow Internet access to a CORP office.

access-list CORP-IN extended permit object-group Web-Ports object CORP-USER-NET any

object-group service Web-Ports
description Server access to internet ports
service-object tcp destination eq www
service-object tcp destination eq https

object network CORP-USER-NET
subnet 10.218.0.0 255.255.255.128
description CORP - User Network

Per my understanding, it should be configured as follows:

access-list CORP-IN extended permit object CORP-USER-NET any object-group Web-Ports.

To me, its almost configured backwards. But it's working, since users are able to get internet access. Can someone explain this?

Re: Firewall Rule Interpretation

Nagaraja Thanthry — Tue, 18 Jan 2011 20:36:33 GMT

Hello,

Since your object-group Web-Ports consists of service objects, the way it is configured seems to be correct. You can check the access-list by issuing "show access-list CORP-IN" command.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800d641d.shtml#serv

Hope this helps.

Regards,

Re: Firewall Rule Interpretation

ksarin123_2 — Tue, 18 Jan 2011 21:07:23 GMT

So in this case, what benefit do I get from using enhanced service objects? Since I am only using port 80, 443 I could have used a protocol specific service object as indicated below, correct?

object-group service test tcp

port-object eq 80

port-object eq 443

So now I know the configuration I listed in my original post works, but again, am I really deriving any benefit from doing it that way? My guess is no. What do you think?

Re: Firewall Rule Interpretation

Nagaraja Thanthry — Tue, 18 Jan 2011 21:09:09 GMT

In your case, you are not getting any advantage. The enhanced service object is used when you need to group multiple protocols and ports into one group.

Hope this helps.

Regards,