topic Re: A question about ASA 8.3 global ACLs against interface ACLs in Network Security

A question about ASA 8.3 global ACLs against interface ACLs

shaijosef — Mon, 11 Mar 2019 17:57:41 GMT

Hello Cisco Experts,

I have a question about the Global ACLs feature introduced in ASA 8.3.

Which ACLs are match first, Global ACLs or the regular interface-base ACLs?

As I understood, if both Blobal and interface-base ACLs exist in the policy, the firewall will try to match (incoming/outgoing) traffic against the interface-base ACLs and if no match is found then the firewall tries to match the traffic against the Blobal ACLs.

is that correct?

thank you

Re: A question about ASA 8.3 global ACLs against interface ACLs

edadios — Thu, 10 Jun 2010 13:03:28 GMT

It matches interface acl first before global.

Here is the documentation for your reference :

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/access_rules.html#wp1083595

####

You can configure global access rules in conjunction with interface access rules, in which case, the specific interface access rules are always processed before the general global access rules.

####

Re: A question about ASA 8.3 global ACLs against interface ACLs

shaijosef — Thu, 10 Jun 2010 13:47:53 GMT

thanks a lot