topic Re: The ACL doesn´t work with the same security level in Network Security

The ACL doesn´t work with the same security level

emilio.borbolla — Mon, 11 Mar 2019 17:08:41 GMT

I have an ASA, with the same security level in all interfaces. I define an ACL in the interface A. When I origin a new connection from interface B to web server (in side of interface A) , If I try to deny this access in the ACL apply at the interface A, the ACL is not working well I don´t see any matchs but if I configure a capture I see the flow correctly.

Do you have any idea or what could be happens?

If you want more details, please let me know.

Thanks for your help.

Emilio Borbolla

Re: The ACL doesn´t work with the same security level

emilio.borbolla — Fri, 12 Feb 2010 19:23:55 GMT

Sorry, I forget to comment that, I am using "same-security-traffic permit inter-interface" command.

Re: The ACL doesn´t work with the same security level

Collin Clark — Fri, 12 Feb 2010 20:22:15 GMT

Can you post the relevant part of the ACL and the access-group configuration lines?

Re: The ACL doesn´t work with the same security level

emilio.borbolla — Fri, 12 Feb 2010 20:38:31 GMT

The coneccion begins from IP 200.4.145.97 in R5 interface to IP 200.33.150.202, at the begin I undertand the syc pass, but the aswer should be dropp

interface Ethernet0
speed 100
duplex full
nameif R5
security-level 100
ip address 204.124.107.254 255.255.255.252
!
interface Ethernet1
speed 100
duplex full
nameif Reduno
security-level 100
ip address 10.105.191.81 255.255.255.248
!
access-list 110 line 1 extended permit ip 204.124.106.128 255.255.255.128 host 201.147.131.21
access-list 110 line 2 extended permit ip 204.124.106.128 255.255.255.128 204.124.107.0 255.255.255.0
access-list 110 line 3 extended permit ip 204.124.106.128 255.255.255.128 204.124.104.240 255.255.255.248
access-list 110 line 4 extended permit ip 204.124.106.128 255.255.255.128 200.4.145.0 255.255.255.0
access-list 110 line 5 extended permit tcp host 200.4.155.230 204.124.104.240 255.255.255.248
access-list 110 line 6 extended permit tcp host 200.4.155.230 200.4.145.0 255.255.255.128
access-list 110 line 7 extended permit tcp host 200.33.150.202 204.124.104.240 255.255.255.248
access-list 110 line 8 extended deny tcp host 200.33.150.202 200.4.145.0 255.255.255.128
!
access-group 110 in interface Reduno
!
access-list ebg line 1 extended permit ip host 200.33.150.202 200.4.145.0 255.255.255.128
!
!
same-security-traffic permit inter-interface
!
!
!
FWPIX525-NOC# sh capture
!
!
FWPIX525-NOC# sh capture captura
643 packets captured
   1: 16:38:21.925611 200.33.150.202.80 > 200.4.145.97.1063: S 3203090713:3203090713(0) ack 2654701753 win 16384
   2: 16:38:21.954052 200.33.150.202.80 > 200.4.145.97.1063: P 3203090714:3203091080(366) ack 2654702155 win 65133
   3: 16:38:21.990488 200.33.150.202.80 > 200.4.145.97.1063: P 3203091080:3203091546(466) ack 2654702565 win 64723
   4: 16:38:22.017821 200.33.150.202.80 > 200.4.145.97.1063: . 3203091546:3203092806(1260) ack 2654702976 win 64312
.....
....
....

Re: The ACL doesn´t work with the same security level

Collin Clark — Fri, 12 Feb 2010 20:43:34 GMT

Can you please post the ACL assigned to R5? The access-group config line would help too.

Re: The ACL doesn´t work with the same security level

emilio.borbolla — Fri, 12 Feb 2010 22:31:10 GMT

Thanks Clark,

I don´t remmember about the out ACL that I have in the Reduno interface, maybe my ACL should apply there...

access-group master in interface R5
access-group 110 in interface Reduno
access-group 105 out interface Reduno

access-list master extended permit ip any any

FWPIX525-NOC# sh run access-list 105
access-list 105 extended permit ip 204.124.104.240 255.255.255.240 any
access-list 105 extended permit ip 200.4.145.0 255.255.255.128 any
access-list 105 extended permit ip 204.124.107.224 255.255.255.240 any
access-list 105 extended permit ip host 201.147.131.21 any
access-list 105 extended permit tcp host 204.124.107.131 204.124.106.0 255.255.255.0 eq ftp
access-list 105 extended permit tcp host 204.124.107.131 204.124.106.0 255.255.255.0 eq ftp-data
access-list 105 extended permit tcp host 204.124.107.131 200.4.155.0 255.255.255.0 eq ftp
access-list 105 extended permit tcp host 204.124.107.131 200.4.155.0 255.255.255.0 eq ftp-data
access-list 105 extended permit tcp host 204.124.107.131 200.4.157.0 255.255.255.0 eq ftp
access-list 105 extended permit tcp host 204.124.107.131 200.4.157.0 255.255.255.0 eq ftp-data
access-list 105 extended permit tcp host 204.124.107.131 200.33.137.0 255.255.255.0 eq ftp
access-list 105 extended permit tcp host 204.124.107.131 200.33.137.0 255.255.255.0 eq ftp-data
access-list 105 extended permit tcp host 204.124.107.131 200.33.150.0 255.255.255.0 eq ftp
access-list 105 extended permit tcp host 204.124.107.131 200.33.150.0 255.255.255.0 eq ftp-data
access-list 105 extended permit tcp host 204.124.107.133 host 192.100.183.178 eq ftp
access-list 105 extended permit tcp host 204.124.107.133 host 192.100.183.178 eq ftp-data
access-list 105 extended permit tcp host 204.124.107.133 host 192.100.183.178 eq telnet
access-list 105 extended permit tcp host 204.124.107.133 host 192.100.183.178 gt 1024
access-list 105 extended permit tcp host 204.124.107.133 host 192.100.183.178 eq smtp
access-list 105 extended permit udp host 204.124.107.133 any eq domain
access-list 105 extended permit udp host 204.124.107.133 any gt 1024
access-list 105 extended permit tcp host 204.124.107.133 any gt 1024
access-list 105 extended permit udp host 204.124.107.131 any eq domain
access-list 105 extended permit udp host 204.124.107.131 any gt 1024
access-list 105 extended permit tcp host 204.124.107.151 host 192.100.183.104 eq www
access-list 105 extended permit tcp host 204.124.107.151 host 192.100.183.104 gt 1024
access-list 105 extended permit tcp host 204.124.107.133 host 192.100.183.104 eq www
access-list 105 extended permit tcp host 204.124.107.133 host 192.100.183.104 gt 1024
access-list 105 extended permit tcp host 204.124.107.146 host 192.100.183.104 eq www
access-list 105 extended permit tcp host 204.124.107.146 host 192.100.183.104 gt 1024
access-list 105 extended permit tcp host 204.124.107.158 any eq smtp
access-list 105 extended permit ip host 204.124.107.134 any
access-list 105 extended permit ip host 204.124.107.35 any
access-list 105 extended permit ip host 192.100.183.254 host 192.100.183.253
access-list 105 extended permit ip 204.124.107.208 255.255.255.240 host 192.100.183.183
access-list 105 extended permit ip 204.124.107.88 255.255.255.248 host 192.100.183.183
access-list 105 extended permit ip 152.148.1.0 255.255.255.0 host 192.100.183.183
access-list 105 extended permit ip host 204.124.107.139 host 192.100.183.183

access-list 105 extended permit ip host 204.124.107.141 host 192.100.183.183
access-list 105 extended permit ip host 204.124.107.70 host 192.100.183.183
access-list 105 extended permit ip host 204.124.107.148 host 192.100.183.183
access-list 105 extended permit ip 172.28.1.0 255.255.255.0 host 192.100.183.183

access-list 105 extended permit ip 204.124.107.208 255.255.255.240 host 192.100.183.161
access-list 105 extended permit ip 204.124.107.88 255.255.255.248 host 192.100.183.161
access-list 105 extended permit ip 152.148.1.0 255.255.255.0 host 192.100.183.161
access-list 105 extended permit ip host 204.124.107.139 host 192.100.183.161

access-list 105 extended permit ip host 204.124.107.141 host 192.100.183.161
access-list 105 extended permit ip host 204.124.107.70 host 192.100.183.161
access-list 105 extended permit ip host 204.124.107.148 host 192.100.183.161
access-list 105 extended permit ip 172.28.1.0 255.255.255.0 host 192.100.183.161

access-list 105 extended permit tcp host 204.124.107.2 host 192.100.183.98
access-list 105 extended permit tcp host 204.124.107.3 host 192.100.183.98
access-list 105 extended permit tcp host 204.124.107.116 host 192.100.183.178 eq smtp
access-list 105 extended deny ip 189.254.64.0 255.255.255.0 any
access-list 105 extended deny ip any 192.100.183.176 255.255.255.240
access-list 105 extended deny ip any 192.100.183.96 255.255.255.240
access-list 105 extended deny ip any 192.100.183.32 255.255.255.240
access-list 105 extended deny ip any host 200.4.157.56
access-list 105 extended permit ip 152.148.1.0 255.255.255.0 172.30.38.0 255.255.255.0
access-list 105 extended permit ip 152.148.1.0 255.255.255.0 10.254.3.0 255.255.255.0
access-list 105 extended permit ip 152.148.1.0 255.255.255.0 host 212.179.43.225

access-list 105 extended permit ip 152.148.1.0 255.255.255.0 host 212.179.43.228

access-list 105 extended permit ip 204.124.107.0 255.255.255.0 any
access-list 105 extended permit ip 172.28.1.0 255.255.255.0 any
access-list 105 extended permit ip 172.16.1.0 255.255.255.0 any
access-list 105 extended permit ip host 10.105.191.81 host 10.105.191.86
FWPIX525-NOC#

Re: The ACL doesn´t work with the same security level

Collin Clark — Mon, 15 Feb 2010 14:14:46 GMT

Since you have ACLs both in and out, you will have to go through and verify that it's allowed through both.