ACL vs. Access List Question

[Brendan Wood]

Hello,  I'm in the process of setting up a replacement ASA right now and I have a question about access lists.

I have an ACL defined like: 

access-list outside_access_in extended permit tcp any object host:srv-dmz-l-prj01 eq 1221

And I have a line like this elsewhere in my config:

access-group outside_access_in in interface outside

My questions would be:

1. What is the purpose of the access-group statement here?
2. Would the ACL work on it's own or does it have to be "applied" with the access-group command above?
3. Should I have a different access-group for each interface?  For example, stuff going from public to inside, from public to DMZ, etc.?

I'm very junior with the Cisco ASA, so please dumb down your answers.  :

Thanks.

[balaji.bandi]

Access-lists are created globally and then applied with the access-group command. They can be applied in  or outbound.

[luis_cordova · Accepted solution]

Hi @Brendan Wood ,

What is the purpose of the access-group statement here?

With the access-list command you create the lists in global mode.
With the access-group command you apply the ACL on the interfaces.

Would the ACL work on it's own or does it have to be "applied" with the access-group command above?

ACLs are created in the global mode, but they have no effect if they are not applied to any interface.

Should I have a different access-group for each interface?  For example, stuff going from public to inside, from public to DMZ, etc.?

An ACL can be applied in several interfaces, if the indications of that ACL are useful in all such cases.

Regards

[Brendan Wood]

Very clear and understood.  Thanks!

[luis_cordova]

Hi @Brendan Wood ,

Remember to mark the correct answers as solved, because that helps other users with similar questions.

Regards