ASA Firewall

[rajeshcv49]

Hi All,

ASA Firewall Packet flow,

source address 10.1.1.1 destnation address 192.168.1.1, In firewall acl entry i allowed icmp for 10.1.1.1 to 192.168.1.1, but in global-policy if i drop the icmp packets. Can ping 10.1.1.1 to 192.168.1.1?

[Collin Clark]

You can configure global access rules in conjunction with interface access rules, in which case, the specific interface access rules are always processed before the general global access rules.

[Cisco Freak]

If a packet is permitted in the specific interface rule, but denied in the global policy, will the packet be permitted or denied?

CF

[Shivapramod M]

Hi,

As Collin said, it always look for the interface access list first and then only it will look for the global.

So ideally the interface access list should allow the traffic if it matches.

Thanks,

Shivapramod M

[Cisco Freak]

So anything that is permitted in the interface access-list will not be checked against the global policy. Am I right?

CF

[rajeshcv49]

Yes, Your right

[rajeshcv49]

Thank you Collin Clark.