Cisco ASA - Difference in permit IP and permit tcp in extended ACL

[gryffindor]

Hi,

I am coming from Juniper SRX and is very new to cisco and ASA. We have a new client and they have ASA firewalls. I am trying to understand the meaning and structure of these ACL statements.

From what I gathered, structure for ACL statement will be like 

access-list <ACL-NAME> extended permit tcp <source-ip> <destination-ip> eq <ports>

Below is a reference ACL statement I found in my ASA. 

access-list Client1 extended permit ip object-group External-Range object Srvr-02

External-Range object group contains a few network object hosts (list of IPs of external range) and Srvr-02 is an internal server. This access list is applied inbound on interface connected to client.

My question is does this allow all communication between external range (coming from client side) and Srvr-02. And if we had used 'access-list Client1 extended permit tcp' then we could have specified a particular port and allowed communication on that port only.

[Rob Ingram]

@gryffindor yes, permit ip from that object group allows all ports/protocols to Srv-02. To restrict traffic you'd specific the protocol "<tcp/udp/icmp>" and port "eq <port>". The access-list is then reference in an access-group, which specifies the interface and the direction (in or out). Usually "in".

[gryffindor]

Hi Rob,

Thanks for your reply. Can you please also suggest that in ACL syntax below, ports mentioned will be destination ports. And if we have to some how restrict on basis of source port, can that be done.

access-list <ACL-NAME> extended permit tcp <source-ip> <destination-ip> eq <ports>

Also, I just found one more ACL statement on another firewall and that one is of permit tcp but don't have any eq ports mentioned. Does this mean that here all tcp communication is allowed.

access-list Client2-IN extended permit tcp object-group CNETS object-group Citrix

[Rob Ingram · Accepted solution]

Yes, all tcp ports would be permitted. You can modify the access-list as below to define an object-group of services.

access-list TEST1 extended permit object-group SERVICES-GROUP object-group NET-SRC object-group NET-DST

If you run show access-list Client2-IN this would expand the contents of the object-group, so you can clearly determine the hosts/networks defined in the group.

[gryffindor]

Hi Rob,

Thanks for your reply. I had tried show access-list Client2-IN, but this showed 200 lines of data and I just could not got it. 

But, I've got an understanding on how to apply them. Thanks again for your responses.