Cisco 5520 Rule configurations...

[alatzas]

I am new the the ASA5520 coming from a checkpoint world. I am setting up my acl's (i am used to them being called rules) and noticed that my options are permit and deny. In the Checkpoint world I was able to also tag the line with drop. This was due to the fact that (atleast with checkpoint) even if you said deny it would send a response packet back to the source. Will this happen with the ASA with only a deny or does this firewall handle the deny packets differently?

Thanks in advance

Pete

[mmorris11 · Accepted solution]

The cisco acl which denys is sending the packet to the bit bucket. I can only imagine that the "deny" feature that you are referring to with the CHeckpoint product would amount to a TCP reset and as such would only be applicable when dealing with TCP traffic. This level of fuctionality is delivered at IPS/IDS level on Cisco solutions. CBAC in IOS has an architecture more similar I suppose:

http://www.cisco.com/en/US/products/ps6586/products_qanda_item09186a008009464d.shtml#qa3

but is still not as monolithic as what you have described with the "rule" concept in Checkpoint.

HTH

mike