cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1086
Views
0
Helpful
1
Replies

ASA ACL Help

Hello,

 

Fairly new to ASA, have done some limited work in the past.  Wondering if someone could give me a quick run down on what the following ACL statements do and, following the last statement, is it implicit "deny"?

 

access-list outside-acl; 4 elements; name hash: 0x9bea1c52

access-list outside-acl line 1 extended permit tcp any interface outside eq 3389

access-list outside-acl line 2 remark Allow pinging of firewall

access-list outside-acl line 3 extended permit icmp any interface outside echo

access-list outside-acl line 4 extended permit icmp any interface outside echo-reply

access-list outside-acl line 5 extended deny ip any any log informational interval 300

access-list dmz-acl; 4 elements; name hash: 0x282e44f8

access-list dmz-acl line 1 extended permit udp any any eq ntp

access-list dmz-acl line 2 extended permit ip any host 10.74.0.27

access-list dmz-acl line 3 extended permit ip host 172.22.12.16 any log informational interval 300

access-list dmz-acl line 4 remark 'allow backup'

access-list dmz-acl line 5 extended permit ip any host 10.101.0.160

access-list nat-acl; 1 elements; name hash: 0xf4b526c2

access-list nat-acl line 1 extended permit ip 172.22.0.0 255.255.0.0 any

 

Any help is appreciated!

 

 

1 Reply 1

BmfL
Level 1
Level 1

Those ACLs are permitting and denying IPs, protocols, etc…, for example:

 

access-list outside-acl line 1 extended permit tcp any interface outside eq 3389:

 

Permits tcp from any interface to outside. That applies when equals to port 3389  which used for Microsoft WBT Server, used for Windows Remote Desktop and Remote Assistance connections (RDP - Remote Desktop Protocol).

ASA has an implicit deny.

 

I would read the following documentation for better understanding:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/access-acls.html#ID-2069-0000011a

 

https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html?referring_site=RE&pos=3&page=https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/access-acls.html

 

In addition, if you have some spare time you can read this book which not only will teach about ACLs but ASA overall:

https://www.ciscopress.com/store/cisco-asa-all-in-one-next-generation-firewall-ips-and-9781587143076

Review Cisco Networking for a $25 gift card