ASA access-group question

[networkadmin411]

If a firewall is configured with a global access-group and an interface in access-group, what the order that access-lists would be processed?

[Rob Ingram · Accepted solution]

Hi,
An ACL applied to an interface is processed before the global ACL.

Usually I find most organisations don't use a global ACL, just an interface ACLs.

FYI, a control-plane ACL is applied before an interface ACL, but the control-plane only processes traffic destined to the ASA itself, where as the interface/global ACL processes traffic through the ASA.

HTH

[networkadmin411]

This matches what I thought. I am in the process of migrating multiple firewalls away from global ACLs and wanted to be sure that I was on the right path. Thank you.