Deny in firewall

[grapevine]

Why do we write a 'deny' statement in the firewall, when there is always an 'implicit deny' at the end of the access list

[Marvin Rhoads]

An explicit deny allows one to generate log messages for the packets that are denied.

Some organizations use those for analysis and/or blacklisting / shunning of the source IPs.

The other reason I have seen cited is that it keeps some auditors happier to see the explicit denies. 🙂

[johnlloyd_13]

further adding to marvin's post, we put an explicit deny (on 'outside' interface) in order to customize the logging level and interval of syslog message 106100.

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4769049