Explicit Deny's on a Firewall

[Joe Bloggs]

Is there any security benefit by putting in specific deny's for say known bad hosts

in a firewall rule base when the rule base has an implicit deny all in it?

[MHM Cisco World]

Just for troubleshooting

You can check hit and log when you add deny 

That it

MHM

[Joe Bloggs]

So just logging then in your opinion?

I can't see any other reason to have specific deny's in above a permit as the implicit deny would kick in.

[MHM Cisco World]

Above or below?

Below permit before implicit deny use for troubleshoot 

Above permit meanly use to deny specific host from subnet' i.e.

We deny host A in subnet 10.0.0.0

Then we permit subnet 10.0.0.0

MHM

[Rob Ingram]

@Joe Bloggs yes there is. The implicit deny rule will only be hit if there is no more specific rule higher up in the the firewall ruleset that permits the traffic. In some circumstances you may wish to block traffic, for example, you have a firewall rule allowing "any" source to a hosted webserver. So you would add a deny rule from known bad hosts above the allow rule to ensure those bad hosts cannot access the webserver.

[Joe Bloggs]

So i appreciate if you have some overly permissive rule and you wanted to stop one specific host from hitting that rule putting a deny in above makes sense.

But if you only have specific ip's talking to specific ip's on specific ports is there any point putting an ACE at the top of the rule base dropping/denying traffic from other hosts?

[Rob Ingram]

@Joe Bloggs as mentioned, you may need to use it in some circumstances. Each environment and firewall ruleset is different, configure the rules to meet your needs.

If you have strict ACE with specific IP addresses/networks communicating, then no, you may not require an explict deny rule above.