Hi,
ASA has the possibility from 8.3 software level onwards to use "global" ACL that is attached globally for every interfaces ingress direction.
According to Cisco documentation any interface ACL will override the "global" ACL. So I would imagine that you would have to have interface ACL for the ingress direction of each interface and then a "global" ACL with only "deny ip any any" or "deny ip any any log" to which every connection that didnt match interface ACL would "drop" to.
Personally I have never started using "global" ACL. I simply like the interface based ACLs and I have no reason to change. Therefore I would personally use a separate "deny ip any any" at the bottom of every interface ACL. When you add it for the first time it naturally goes to the bottom of each ACL. Adding more rules to the ACL later would require you to add them in between with "line" number parameter.
Maybe I'll do a simple test for this on my home ASA soon to confirm that the operation is as mentioned above.
Heres a quote from Cisco ASA Command Reference
Usage Guidelines for Global Rules
The access-group global command applies a single set of global rules on all traffic, no matter which
interface the traffic arrives at the ASA.
Global rules for the access-group global command support extended access lists only.
All global rules apply only to traffic in the ingress (input) direction. Global rules do not support egress
(output) traffic.
Global rules for access-group global do not support the control-plane nor the per-user-override
options that are supported in interface-specific access rules.
If global rules are configured in conjunction with interface access rules, then the interface access rule,
which is specific, is processed before the global access rule, which is general.
- Jouni
