cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5225
Views
0
Helpful
4
Replies

What does 'ip' mean (low level) in an ASA ACL?

aLeffingwell
Beginner
Beginner

Hey All,

Having a moment here - I see it every day: access-list SOMETHING extended permit ip ........

I use 'ip' when I intend to say 'everything' but I didn't know how the IOS actually summarized 'ip' internally.

All of the other port 'macros' (not really sure you would call them?) like www, and ftp, have direct correlations like 80, 21.. Anyway, just got me thinking.  Looking forward to learning what it really means at the lower level!

Thanks in advance,

Kindest Regards,

Alan

1 Accepted Solution

Accepted Solutions

Hi,

Yes it should pretty much allow everything through the firewall.

Most common are the mentioned TCP (every port), UDP (every port) and ICMP

Naturally some traffic might be controlled by the ASA differently and a simple ACL might not do the trick. Might have to for example enable or disable inspections on the ASA.

- Jouni

View solution in original post

4 Replies 4

Jouni Forss
Mentor
Mentor

Hi,

The "access-list" rule containing "permit ip" basically allows all the traffic

This includes TCP, UDP and ICMP

When you use either TCP or UDP then you can permit separate ports

- Jouni

Hey Jouni,

Yeah, this is how I understood it, so are you saying that at the low level it's like putting: Extended permit TCP _every port, UDP _every port, ICMP _every flag?

I know I'm overthinking this, but curiosity did kill the cat !!  Perhaps I should just leave my understanding at 'ip' means 'everything'.

Thanks!

Kindest Regards,

ALAN

Hi,

Yes it should pretty much allow everything through the firewall.

Most common are the mentioned TCP (every port), UDP (every port) and ICMP

Naturally some traffic might be controlled by the ASA differently and a simple ACL might not do the trick. Might have to for example enable or disable inspections on the ASA.

- Jouni

Hey Jouni,

Awesome!  Thanks for relieving my brain fart moment!

Kindest Regards,

ALAN

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers