topic Re: Access-list for internet in Network Security

Access-list for internet

luciano_rangel — Mon, 11 Mar 2019 16:21:03 GMT

Good afternoon

I have a firewall with three interfaces (outside, inside "172.16.0.0/16" and dmz "10.1.1.0/24") and I need access from inside network to internet on port 80 as access-list below.

access-list inside_access_in extended permit tcp host 172.16.0.0 255.255.0.0 0.0.0.0 0.0.0.0 eq http

What would be the best practice for the machines in network inside dont access others networks on port 80, already destination is any?

Create a deny rule in the middle of the example below

access-list inside_access_in extended deny ip 172.16.0.0 255.255.0.0 10.1.1.0 255.255.255.0

access-list inside_access_in extended permit tcp 172.16.0.0 255.255.0.0 0.0.0.0 0.0.0.0 eq http

Create outbound access-list on interface dmz?

Thanks for all

Re: Access-list for internet

Jon Marshall — Tue, 29 Sep 2009 20:38:33 GMT

Luciano

Doesn't make a huge amount of difference. Personally i would go with your first example ie.

access-list inside_access_in extended deny ip 172.16.0.0 255.255.0.0 10.1.1.0 255.255.255.0

access-list inside_access_in extended permit tcp 172.16.0.0 255.255.0.0 0.0.0.0 0.0.0.0 eq http

Jon

Re: Access-list for internet

luciano_rangel — Tue, 29 Sep 2009 20:54:23 GMT

Hi Jon,

Endende that by creating an outbound access-list we would have another access-list to be read and this would affect the access time to the devices.

Am I correct?

Thanks for help.

Re: Access-list for internet

Jon Marshall — Tue, 29 Sep 2009 21:04:02 GMT

Luciano

"that by creating an outbound access-list we would have another access-list to be read and this would affect the access time to the devices."

Yes but probably not that noticeable. However there is an argument to say drop the traffic on the nearest interface to the source. That way the traffic does not have to go from the inside to the DMZ interface before being dropped. That's why i would go with your first option.

Jon