ACL do you define all traffic?

[Matt Roberts]

Is it best practice to create an ACL on each interface that specificies what traffic is allowed and everything is denied?

I've got a couple of interface on my ASA that someone has put in a rule that says allow any to any. I would assume that would not be a good idea.

[Jouni Forss]

Hi,

I personally prefer to only allow traffic from the actual source network that are located behind the interface instead of specifying the source as "any" in the ACL statement.

I also tend to add a "deny ip any any" statement at the end of the interface ACL (even though it already contains Implicit Deny). This is because this will let me actually see the hitcount of denied traffic on that interface while the Implicit Deny counter cannot be seen.

Naturally if you have the "ip verify reverse-path " configured for your LAN/DMZ interface then that will already make sure that traffic is not allowed from source addresses/networks that according to ASA routing table are NOT located behind the source interface.

- Jouni