cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to Cisco Firewalls Community


258
Views
0
Helpful
3
Replies
Highlighted
Frequent Contributor

ASA access list query

Hi,

I have certain rules in firewall as below:

acl servers_in line 1 extended permit tcp 192.168.100.2 255.255.255.252 host 10.83.0.2 eq 443
acl servers_in line 2 extended permit tcp 192.168.100.2 255.255.255.252 host 10.83.0.2 eq 445
acl servers_in line 3 deny ip 192.168.100.2 255.255.255.252 any

acl servers_in line 4 extended permit tcp 192.168.100.10 255.255.255.224 host 10.83.0.10 eq 25
acl servers_in line 5 extended permit tcp 192.168.100.10 255.255.255.224 host 10.83.0.11 eq 80
acl servers_in line 6 deny ip 192.168.100.10 255.255.255.224 any

acl servers_in line 7 permit ip 192.168.100.0 255.255.255.0 any

My goal is to restrict 192.168.100.2 /30 to only 10.83.0.2 on specific service. similar goes for the other from line 4-6.
& deny these 192.168.100.2 /30 & 192.168.100.10 255.255.255.224 from accessing anything else, which is why i
thought of putting deny after these.
however due to some other reasons, i cant do away with line 7.
With this i find restrictive lines 1-2 and 3-4 arent really working. whereas if i remove the deny it works properly(as it should).
Please help me to align & have proper rules in place so that i can stil restrict the groups to what they are required to.

Thank You.

3 REPLIES 3
Beginner

Re: ASA access list query

I'm sorta surprised that the firewall let you put in an ACL with a non-pairing IP/mask (192.168.100.2 255.255.255.252). When you specify the subnet mask the IP must be the network IP not a 'host' IP, unless the mask is /32. You might try the following:

acl servers_in line 1 extended permit tcp host 192.168.100.2 host 10.83.0.2 eq 443
acl servers_in line 2 extended permit tcp host 192.168.100.2 host 10.83.0.2 eq 445
acl servers_in line 3 extended deny ip host 192.168.100.2 any

acl servers_in line 4 extended permit tcp
host 192.168.100.10 host 10.83.0.10 eq 25
acl servers_in line 5 extended permit tcp
host 192.168.100.10 host 10.83.0.11 eq 80
acl servers_in line 6 extended deny ip
host 192.168.100.10 any

acl servers_in line 7 extended permit ip 192.168.100.0 255.255.255.0 any

Good luck!

James

Highlighted
Frequent Contributor

Re: ASA access list query

Apologies, my mistake.

It is infact 192.168.100.0 255.255.255.252


With these networks of hosts involved, i believe the acls wont work as required.


Please suggest.

Highlighted
Cisco Employee

Re: ASA access list query

acl servers_in line 1 extended permit tcp 192.168.100.0 255.255.255.252 host 10.83.0.2 eq 443
acl servers_in line 2 extended permit tcp 192.168.100.0 255.255.255.252 host 10.83.0.2 eq 445
acl servers_in line 3 deny ip 192.168.100.2 255.255.255.252 any

acl servers_in line 4 extended permit 192.168.100.0 255.255.255.224 host 10.83.0.10 eq 25
acl servers_in line 5 extended permit 192.168.100.0 255.255.255.224 host 10.83.0.11 eq 80
acl servers_in line 6 deny ip 192.168.100.10 255.255.255.224 any

will ONLY allow 192.168.100.1 and .2 going to 10.83.0.2 on ports 443 and 445.
And ONLY 192.168.100.1 up to .30 going to 10.83.0.10 and .11 on ports 25 and 80 respectively.

Are those only what you want to allow?

I hope it helps.

PK

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here