ACL deny ip any any on outside interface

[mahesh18]

Hi Everyone,

For testing purposes i apply ACL on the outside interface of ASA

access-list outside_in extended deny ip any any  ----------------------for testing purpose only 

Below are the ACL on the outside interface of ASA

access-list outside_in remark Allow ping from any device of  outside interface of ASA  to Switch in DMZ Network.     -------works fine

access-list outside_in extended permit icmp any host 192.168.69.1 echo log-----------------------------------------does not work

access-list outside_in remark Allow Telnet from Outside interface to  Switch in DMZ--------------------------does not work

access-list outside_in extended permit tcp any host 192.168.69.1 eq telnet----------------------------------------does not work

access-list outside_in remark Cut Through Proxy

access-list outside_in remark Allow HTTP access To DMZ Switch From Outside

access-list outside_in extended permit tcp any host 192.168.69.1 eq www log-----------------------------works fine

I read that ACL is used to control traffic that passes through the ASA  so in this case it does not allow 3 ACL  rules as traffic is passing through the

ASA  to DMZ right?

Need to confirm the cut through proxy works fine even though we have ACL on outside deny any any because ASA  is responding  on behalf of DMZ switch ?

Also for cut through proxy traffic is coming for the ASA not passing through the ASA  right?

Regards

Mahesh

[Julio Carvajal · Accepted solution]

Hello,

I read that ACL is used to control traffic that passes through the ASA  so in this case it does not allow 3 ACL  rules as traffic is passing through the

ASA  to DMZ right?

Not sure what you mean, I mean if you set this line on number one

access-list outside_in extended deny ip any any

Of course the other 3 acl lines will not be taken into consideration.

If the access-group goes on the inbound direction it will aply to any traffic that crosses the Outside interface ( to inside, DMZ or whatever)

Need to confirm the cut through proxy works fine even though we have ACL on outside deny any any because ASA  is responding  on behalf of DMZ switch ?

Also for cut through proxy traffic is coming for the ASA not passing through the ASA  right?

Exactly, the cut-through proxy it's an entire different mechanism used to authenticate users while they are trying to acces certain services,

Totally different from regular ACLs

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

[mahesh18]

Hi Julio,

You confirmed my thoughts.

Regards

MAhesh