topic Re: automatic ACL when using access-group command in Network Security

automatic ACL when using access-group command

BartV1982 — Mon, 11 Mar 2019 16:59:45 GMT

Last my collegue asked me what is the default ACL when you put access-group on a interface

when looking on cisco.com I found :

If the specified access list does not exist, all packets are passed.

But this is for routers, how is this for ASA firewalls?

Can anyone help us?

Panos Kampanakis — Wed, 27 Jan 2010 02:10:57 GMT

The ASA will not let you apply an ACL that is not configured. It will bark

ASA-5505(config)# access-g not-exist in interface inside
ERROR: access-list does not exist

I hope it helps.

Kureli Sankar — Wed, 27 Jan 2010 04:33:52 GMT

It depends on the security level configured for that interface.

By default traffic from high security to low security (inside to outside) WILL be allowed like in the routers without any access-group applied.

But, traffic from low to high security (outside to inside) WILL NOT be allowed without access-group applied on the interface.

-KS

BartV1982 — Wed, 27 Jan 2010 07:56:51 GMT

Hey pkampana

thx for this reply

it was exactly what we were looking for but we couldn't test it our-self as we don't have an ASA box

@kusankar thank you for your reply but pkampana provided the answer we were looking for