Very simple ACL question

[billmatthews]

I am looking over a config of an old ASA5520.  One network has this ACL applied:

access-list acl_dmztest extended permit icmp any any

access-list acl_dmztest extended permit ip any any

access-list acl_dmztest extended permit tcp host 10.10.10.10 host 10.20.20.20 eq http

Isn't that last statement unneccessary?  Would there ever be a valid reason for doing it like that?  I'm thinking maybe for logging/rule tracking?  Anything else?

Thanks

Bill

[ajay chauhan]

Hi Bill,

There is a simple rule to put ACL on ASA/PIX. Just remember from Lower Security Level to Higher security level implicit deny is  there so to allow this communication you will have to configure ACL to allow specific .

From higher to lower is always allowed no rules required untill unless you want to block some traffic.So cofiguring deny would be good option.

Outside default security level is = 0

Inside Default Security level = 100

DMZ can be anything =0 to 100

Hope this help.

Thanks

Ajay

[billmatthews]

Hi Thanks Ajay,

I understand that.  But if line#2 permits ip any, then why would you need line#3 ?

[ajay chauhan]

If permit any any then 3rd not required.