Traffic to and from the ASA Firewall

[muazzamss]

How the access to / from the ASA device controlled?

1. What about traffic originating from the ASA? Example Syslog traffic, SNMP trap, TACACS etc. going to devices to the "inside" interface. Do we need any kind of access list or how do we control this traffic?

2. Traffic coming to the ASA firewall itself? Ex: ICMP, SNMP etc. What if this traffic is coming from outside interface?

[Pranay Prasoon]

Hi,

For ssh, telnet http and icmp, you can control traffic with command like

ssh <network> <subnet mask> interface

telnet <network> <subnet mask> interface

http <network> <subnet mask> interface

icmp permit/deny

the initial three command are for traffic coming to ASA. ICMP can be used in both outbound or inbound traffic.

However, you can also use control-plane access-list, since interface level access-list is only for through-the-box traffic.

However, above three commands take preference over control-place access-list.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_rules.html

See "management access rules section"

Thanks