ASA ACL Problem

[eli_d_iceman]

HI,

Question regarding the acl operation of ASA.

Setup using ASA only.

inside interface -  this is where the server is located.

outside interface - this is where the user is located.

Test 1.

Policy - allow the telnet connection from the user to the server (telnet server).

Result - user can telnet to the server.

Test 2.

Policy - deny the telnet connection from the user to the server (telnet server).

Result - the user that already have an establish telnet session to the server stays connected.

            if the user disconnects the telnet session and try to connects again, the user was denied for the telnet connection because of the policy.

I do the same testing using an L3 switch (no ASA) and apply the access group to the SVI inbound.

Setup using L3 switch only.

vlan 2 -  this is where the server is located.

vlan 7 - this is where the user is located.

Test 1.

Policy - allow the telnet connection from the user to the server (telnet server).

Result - user can telnet to the server.

Test 2.

Policy - deny the telnet connection from the user to the server (telnet server).

Result - the user that already have an establish telnet session to the server was disconnected.

           new telnet connection to the server was denied because of the policy.

I would like to ask about the difference in the result between the ASA and the L3 switch.

Do i have to do some config with ASA to achieve the same result as the L3 switch.

Also , if you can provide documentations w/ cisco regarding this.

TIA

[padatta · Accepted solution]

Hi,

In ASA, ACL changes do not affect existing connections. Existing connections will have an entry in the state 
table. So they are not subjected to ACL checks.

ACL checks are done at the connection creation time, only new connections after the change will be subjected 
to ACL checks.

Switches do not maintain a connection state table and so all packets are subjected to ACL checks.

Check the 'Note' section in this ASA link.

http://www.cisco.com/en/US/partner/docs/security/asa/asa80/configuration/guide/traffic.html#wp1074528

Paps

[eli_d_iceman]

Thanks!