FTP ACL on inside and Outside Interface of ASA

[mahesh18]

Hi Everyone,

On one of our Clients Network setup we have ACL  that permits FTP to  certain IP address on the inside interface.

Then they have outside interface of ASA which also has ACL that permits certain IP to allow FTP  in outgoing direction.

Need to undertstand is this design of config FTP is more secure ?

On my home ASA with base license i config the ACL to allow the FTP  to certain IP only on inside interface as traffic enters the ASA.

I was trying to LAB the clients ASA setup  on my home lab.

On my outside interface of ASA  i have ACL direction --------access-list outside_in

Is there way i can config  ACL  to allow FTP on outside interface also to allow same IP as on Inside interface?

As i read that on single interface you can have ASA only in 1 Direction.

Hope it make sense.

Regards

MAhesh

[Julio Carvajal · Accepted solution]

Hello

U shoudl be able to aply one acl per direction per interface

Now if you apply it on the outside interface u should be fine as the acl check would be the same on both interfaces.

Do u follow me


Sent from Cisco Technical Support Android App

[mahesh18]

Hi Julio,

You can explain me in detail that how can i apply on outside interface and which direction?

Thanks

Mahesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

I am not sure I get the question...

But if you have an Inside FTP server which you will protect from the outside users and you want to restrict access to it,

You could use the ACL on the outside interface of the ASA,

Let's say you are running 8.4

The server IP address is 192.168.10.2

You will use the interface IP address to NAT the server

And you will only allow access from 4.2.2.2 to that server on the FTP service

so the Config would be something like this:

Object network FTP_Server

host 192.168.10.2

object service FTP

service source eq 21

nat (inside,outside) source static FTP_Server interface service FTP FTP

Now the ACL, to make it restrictive

access-list out_in permit tcp host 4.2.2.2 host 192.168.10.2 eq 21

access-group out_in in interface outside

Regards,

Julio

[mahesh18]

Hi Julio,

Here i was refering to External FTP server  on internet.

Clients FW config has ACL on inside interface of Fw that allows FTP to certain IP only.

Then they have ACL on the outside interface of FW  direction is traffic going out from the outside interface of FW.

I was referring to know if this setup is more secure to config ACL to allow FTP?

Thanks

Mahesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

If that's the case then:

I would say:

If you have more than the 2 interfaces (Inside,Outside) then you could apply an ACL on the outside interface via OUT but this is far from common,

What we usually see is just an ACL on each interface direction inbound,so you can filter the traffic to entering the device and taking resources from the ASA,

So my recommendation:

Just use one ACL for each traffic pattern and try to use it on a way that the traffic is limited to enter the traffic, in our case would be the one on the inside in direction ( you already have it, no need to use another one for the same traffic)

Regards

[mahesh18]

Hi julio,

If in network we  have many inside interfaces  and there is lot of lan segmentation then i think its ok to have ACL for

FTP on both inside and outside interfaces.

Thanks

MAhesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

When you say many inside interfaces... You mean a lot of interfaces with a higher security level right?

Well even if that is the case you will be placing ACLs on two sides of the network..

My recomendation would be place them as close to the source as possible, be as granular and restrictive as you can because you will be securing your perimiter,

I dont think is a good move to place the same ACL on 2 different sides, it just dont sound right

Regards

[mahesh18]

Hi Julio,

When i say many inside interfaces yes it mean lot of interfaces with higher security level.

Regards

Mahesh

[Julio Carvajal]

Hello Mahesh,

Okey, yeah I dont see any reason for having a doble check regarding the same traffic patterns,

Any other question I can answer from u regarding this?

[mahesh18]

Hi Julio,

No more questions on this.

Thanks

Mahesh