cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

4147
Views
0
Helpful
4
Replies
Highlighted
Beginner

What does 'ip' mean (low level) in an ASA ACL?

Hey All,

Having a moment here - I see it every day: access-list SOMETHING extended permit ip ........

I use 'ip' when I intend to say 'everything' but I didn't know how the IOS actually summarized 'ip' internally.

All of the other port 'macros' (not really sure you would call them?) like www, and ftp, have direct correlations like 80, 21.. Anyway, just got me thinking.  Looking forward to learning what it really means at the lower level!

Thanks in advance,

Kindest Regards,

Alan

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Hi,

Yes it should pretty much allow everything through the firewall.

Most common are the mentioned TCP (every port), UDP (every port) and ICMP

Naturally some traffic might be controlled by the ASA differently and a simple ACL might not do the trick. Might have to for example enable or disable inspections on the ASA.

- Jouni

View solution in original post

4 REPLIES 4
Highlighted
Mentor

Hi,

The "access-list" rule containing "permit ip" basically allows all the traffic

This includes TCP, UDP and ICMP

When you use either TCP or UDP then you can permit separate ports

- Jouni

Highlighted

Hey Jouni,

Yeah, this is how I understood it, so are you saying that at the low level it's like putting: Extended permit TCP _every port, UDP _every port, ICMP _every flag?

I know I'm overthinking this, but curiosity did kill the cat !!  Perhaps I should just leave my understanding at 'ip' means 'everything'.

Thanks!

Kindest Regards,

ALAN

Highlighted

Hi,

Yes it should pretty much allow everything through the firewall.

Most common are the mentioned TCP (every port), UDP (every port) and ICMP

Naturally some traffic might be controlled by the ASA differently and a simple ACL might not do the trick. Might have to for example enable or disable inspections on the ASA.

- Jouni

View solution in original post

Highlighted

Hey Jouni,

Awesome!  Thanks for relieving my brain fart moment!

Kindest Regards,

ALAN

Content for Community-Ad