Global ACL or Per-Interface ACL ?

mathieupoussin · ‎12-22-2012

Hello.

What do you use or recommend to use on your ASA ? I've used for a long time, Per-Interface ACL but now global ACL are available.

But what are the advantages of having everything in one ACL ? What do you recommend ?

Thank you.

Best Regards,

Mathieu

Jouni Forss · ‎12-22-2012

Hi,

I personally use per interface ACL and ACLs are always attached to direction "in" with the "access-group" command.

I/We have used "global" ACL in one environment and so far it has been the last one.

I guess its also down to what you are used to. I guess some other firewalls from other manufacturers use a "global" type of ACLs and for those users Cisco ASAs "global" ACL might be more natural choice

Personally I can't think of ever changing to using "global" ACL. And I can't see any current setup we have where it would bring anything extra to the setup.

So my personal suggestion would be to keep using interface based ACL and perhaps test the "global" ACL in some firewall if possible to make the final decision what suits you the best.

- Jouni