ASA ACL in vs out

[mmt]

Hi,

can anyone say which one is better, to use acl on interfaces and apply them inbound, or outbound. i mean there are 2 strategies here , you can apply on all your interfaces inbound ACL and permit from each interface, or you can permit outbound to each interface what you need to open inside that interface.

[handsy]

The 'normal' way, or certainly the way I deploy ACLs on my ASAs, is to write ACLs and apply them inbound on external interfaces.

Some useful bits of knowledge on ASA behaviour:

-ASAs by default will automatically allow traffic outbound from a high security interface to a low security interface.

-If a connection is allowed 'in' to an ASA, then it will automatically be allowed 'out', as ASAs are stateful. This means you do not need to write an 'in' and an 'out' ACL, just an 'in'.

-I use NAT to control access 'out' of my ASAs, as without a NAT statement an IP can't go any further than the ASA itself.

Hope this helps :)