topic Re: PIX ACL Question (v7.2) in Network Security

PIX ACL Question (v7.2)

nagel — Mon, 11 Mar 2019 15:53:08 GMT

Can someone explain to me what the difference in the following 2 ACLs are :

access-list outside_acl extended permit udp any any eq 4500

access-list outside_acl extended permit udp any eq domain any

This is the access-list applied to my outside interface. (in interface outside)

The "domain" entry is one that I inherited and is the only one formatted SOURCE PROTOCOL DESTINATION

All others are formatted SOURCE DESTINATION PROTOCOL

I have googled this till I'm blue in the clicker and I see lots of reference to the exact same entry but no one ever explains exactly "what it does" or why it is "formatted" like that.

Thanks in advance for the assistance...

Re: PIX ACL Question (v7.2)

andrew.prince — Thu, 09 Jul 2009 15:10:55 GMT

The difference is:-

access-list outside_acl extended permit udp any any eq 4500 - allows any source to any destination, as long as the destination UDP port equals 4500

access-list outside_acl extended permit udp any eq domain any - allows any source to any destinaton as long as the source UDP port is 53

HTH>

Re: PIX ACL Question (v7.2)

nagel — Thu, 09 Jul 2009 16:49:36 GMT

That is exactly what I was looking for. One more question. Still not sure why the DNS entry would be on my outside interface as I can think of no reason why someone coming in from outside would need this access.

We do have local DNS on a box inside and and our main DNS is provided by ISP.

Any good reason you can think of for having this entry?

Thanks again....

Re: PIX ACL Question (v7.2)

Jon Marshall — Thu, 09 Jul 2009 17:14:43 GMT

Lonnie

"Any good reason you can think of for having this entry?"

If you are not hosting a DNS server internally that answers requests from the Internet then no i can't see a good reason. Even if you were you would expect the destination to be tied down to at least just your DNS servers.

As UDP is pseudo-stateful on the pix, ie a timer is used, then any connections initiated from the inside would not need a line in the outside acl.

Perhaps the previous admin was trying to get something working, tried that line and forgot to take it out. Surprising how often that happens 🙂

Jon

Re: PIX ACL Question (v7.2)

nagel — Thu, 09 Jul 2009 18:35:00 GMT

Thanks much for the confirmation on my suspicion...think I'll remove and see what happens. Cheers