There seem to be a lot of misunderstanding in how the PIX firewall processes the ACL's. I always thought I did understand it, because I always been told that the PIX did process the whole ACL and selects the best fit. But, since today I do not understand. Why? Well, I have the following problem.
I have bound an inside_in access-list to the inside interface (why? because I don't follow the defaulkt policy that all outside traffic is considers save, thinking of trojans et cetera. This said here the discription to my problem.
Our customers will have only access to the web via a proxy-server, with some exeptions made for some engineers. The access-list bound to the inside interface looked like this:
access-list inside_in permit tcp host <ip-address_engineer1> any eq http
access-list inside_in permit tcp host <ip-address_engineer2> any eq http
access-list inside_in permit tcp host <ip-address_proxyserver> any eq http
access-list inside_in deny tcp any any eq http
access-list inside_in permit ip any any
This access-list worked fine, but the I tried to build it up a bit, by providing some users ftp access and denying all other traffic. So, I extended the list to the following:
access-list inside_in permit tcp host <ip-address_engineer1> any eq http
access-list inside_in permit tcp host <ip-address_engineer2> any eq http
access-list inside_in permit tcp host <ip-address_proxyserver> any eq http
access-list inside_in deny tcp any any eq http
access-list inside_in permit tcp host <ip-address_engineer1> any eq ftp
access-list inside_in permit tcp host <ip-address_engineer1> any eq ftp-data
access-list inside_in permit tcp host <ip-address_engineer2> any eq ftp
access-list inside_in permit tcp host <ip-address_engineer2> any eq ftp-data
access-list inside_in deny ip any any
I expected that this kind of ACL would give ftp and http access to the outside, and by putting in the deny ip any any it would deny all other traffic, but much to my surprise, it did not. In fact it did just deny all ip traffic, even http :-(
Now I'm wondering if there's anyone who can explain how this example list would be processed in the PIX. I think the PIX does the following while it processes the access-list:
- first look into all ip based statements
- if there is just one ip statement which defines the packet, and it is a deny, drop it
- if there is just one ip statement which defines the packet, and it is a permit, proces further on
- if there are several ip statements for the packet, select the best fit (whereby permit's are best, because it is from inside to outside and this traffic is normally implicit permitted)
- if there are no statements for this packet, permit the packet (implicit permit)
I just want to know if I'm thinkin right and if there's any good document on Cisco which describes the whole process of best fit for PIX ACL's. I haven't been able to find it in the last four weeks (and since I'm just one of those nerds who wants to know it all, I posted this thread).
Thanx in advance and best regards,
Leo Mourits
Senior network specialist, PinkRoccade (Netherlands)
