11-25-2021 10:00 AM
Hello,
Fairly new to ASA, have done some limited work in the past. Wondering if someone could give me a quick run down on what the following ACL statements do and, following the last statement, is it implicit "deny"?
access-list outside-acl; 4 elements; name hash: 0x9bea1c52
access-list outside-acl line 1 extended permit tcp any interface outside eq 3389
access-list outside-acl line 2 remark Allow pinging of firewall
access-list outside-acl line 3 extended permit icmp any interface outside echo
access-list outside-acl line 4 extended permit icmp any interface outside echo-reply
access-list outside-acl line 5 extended deny ip any any log informational interval 300
access-list dmz-acl; 4 elements; name hash: 0x282e44f8
access-list dmz-acl line 1 extended permit udp any any eq ntp
access-list dmz-acl line 2 extended permit ip any host 10.74.0.27
access-list dmz-acl line 3 extended permit ip host 172.22.12.16 any log informational interval 300
access-list dmz-acl line 4 remark 'allow backup'
access-list dmz-acl line 5 extended permit ip any host 10.101.0.160
access-list nat-acl; 1 elements; name hash: 0xf4b526c2
access-list nat-acl line 1 extended permit ip 172.22.0.0 255.255.0.0 any
Any help is appreciated!
11-25-2021 10:58 AM
Those ACLs are permitting and denying IPs, protocols, etc…, for example:
access-list outside-acl line 1 extended permit tcp any interface outside eq 3389:
Permits tcp from any interface to outside. That applies when equals to port 3389 which used for Microsoft WBT Server, used for Windows Remote Desktop and Remote Assistance connections (RDP - Remote Desktop Protocol).
ASA has an implicit deny.
I would read the following documentation for better understanding:
In addition, if you have some spare time you can read this book which not only will teach about ACLs but ASA overall:
https://www.ciscopress.com/store/cisco-asa-all-in-one-next-generation-firewall-ips-and-9781587143076
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide