topic Re: Access denied by implicit rule in Network Security

Access denied by implicit rule

ghermocilla — Fri, 21 Feb 2020 15:22:21 GMT

Hi,

I have a Cisco ASA 5525-X running version 9.5(3)9.

I encountered a kind of weird issue regarding access-list.

For what I know if you are coming from a higher security level going to low, you don't need to explicitly put an access-list to allow access.

What happened to me is that my machines coming from the inside is denied by the implicit deny rule.

NAT is configured properly, every other config is fine.

Anyone of you experienced this?

Re: Access denied by implicit rule

Krash Mole — Mon, 19 Feb 2018 14:03:11 GMT

Please share your configuration.

Re: Access denied by implicit rule

Ajay Saini — Tue, 20 Feb 2018 05:25:32 GMT

Hello,

If you can attach a packet-tracer output or syslogs, we can look into it.

For a start, acl drop does not always means "access-list". It could be due to a variety of reasons like connection timeout etc.

HTH
AJ

Re: Access denied by implicit rule

ghermocilla — Tue, 20 Feb 2018 06:54:23 GMT

here's my config

interface GigabitEthernet0/0.27
nameif outside
security-level 0
ip address 172.16.1.3 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.1.10 255.255.255.0
!
object network Inside-NAT
host 172.16.1.10
!
object-group network Inside-PC
network-object 10.100.1.0 255.255.255.0
!
nat (inside,outside) source dynamic Inside-PC Inside-NAT

It should work right? default behavior of firewall is to allow a higher security level to lower,
even without explicitly having an access-list

Re: Access denied by implicit rule

ghermocilla — Tue, 20 Feb 2018 07:02:45 GMT

that's the result for packet tracer, its being dropped, that why i need to explicitly put an access list like this one:

access-list inside_access extended permit ip object-group Inside-PC any

Re: Access denied by implicit rule

Ajay Saini — Tue, 20 Feb 2018 08:06:55 GMT

Hello,

Do you already have an access-group configured, can you attach following outputs:

show run access-group inside_access

show run access-list inside_access

Ideally, you should not require an access-list for traffic going from high security to low security interface.

HTH

Re: Access denied by implicit rule

ciscoinfo — Mon, 26 Feb 2018 18:00:55 GMT

Hi,

I am also facing something similar.

I have ASA 5545x series firewall running 9.8(2) version.

Even after configuring the interfaces into access-group.

The acls are not getting hit.

Seems like the device is following the default behavior.

Any advice ?

I think I am missing something.

Config :

interface Management0/0
description Management interface connected to Port 3.
speed 100
duplex full
management-only
nameif management
security-level 90
ip address 172.20.40.10 255.255.255.0 standby 172.20.40.11

access-group management_access_in in interface management

access-list management_access_in extended permit icmp any any
access-list management_access_in extended permit tcp any any