topic Re: Restricting Inbound Access on ASA5540 in Network Security

Restricting Inbound Access on ASA5540

l.blair — Mon, 11 Mar 2019 15:45:32 GMT

I have a customer that wants to restrict inbound access from the internet to their webservers to only North American traffic. They have indicated that they have a list of 40,000 IPs that they want to explicitly allow. They would like this restricted access to be provided by the ASA. The IPs are not contiguous. I can't see how this could possibly be done via access-lists that would not kill the box. Any suggestions?

Thanks in advance.

Re: Restricting Inbound Access on ASA5540

Patrick0711 — Thu, 18 Jun 2009 23:12:27 GMT

Blocking by country is the one of the most inefficient ways to restrict access to your configuration. The device will still have to compare all new incoming connections to this access-list which will likely affect the performance of the device.

40,000 IPs/network ranges seems excessive for US IPs...perhaps you could allow only ARIN IP ranges?

https://www.arin.net/knowledge/ip_blocks.html

Re: Restricting Inbound Access on ASA5540

plumbis — Fri, 26 Jun 2009 02:38:54 GMT

It depends on the ASA platform. Every ACE will require memory space. There is also the lookup time required for the ACL checks that again, will depend on the platform for their speed.

Re: Restricting Inbound Access on ASA5540

svaish — Fri, 26 Jun 2009 04:57:32 GMT

Deny based on ip address does not seems to be a good solution as it will eat all the resources on the ASA, you should find some other way of blocking the traffic.

My sugestion would be use an external authentication server and restrict the noumber of connections to the weebserver on asa to 40,000 and provide a username and password to the users.

Re: Restricting Inbound Access on ASA5540

kcaskey — Fri, 26 Jun 2009 14:56:28 GMT

Explain to your customer how simple it is to spoof a source IP address and weigh that against the complexity and performance effects of a monstrous ACL.