ASA 5525X Outside Configuration Confirmation

[Pravin Raj Kanagaraj]

Hi,

The below said access lists are enough to protect the outside interface in ASA 5525X ?

access-list outside line 36 extended deny tcp any any (hitcnt=846) 0x2a966e57
access-list outside line 37 extended deny udp any any (hitcnt=260) 0x6c301697
access-list outside line 38 extended deny ip any any (hitcnt=9898747) 0xfd0ffa4a

Kindly provide your input, thanks in advance.

Regards,

Pravin Raj K

[Pravin Raj Kanagaraj]

Hi,

The below said access lists are enough to protect the outside interface in ASA 5525X ?

access-list outside line 36 extended deny tcp any any (hitcnt=846) 0x2a966e57
access-list outside line 37 extended deny udp any any (hitcnt=260) 0x6c301697
access-list outside line 38 extended deny ip any any (hitcnt=9898747) 0xfd0ffa4a

Kindly provide your input, thanks in advance.

Regards,

Pravin Raj K

[Karsten Iwen]

There is an implicit "deny any" at the end of the ACL. You only need these lines if you want to have drop-statistics for TCP, UDP and all other IP-traffic.

[Pravin Raj Kanagaraj]

Thank you, can you pease confirm implicit deny option at the end of ACL???

[Georg Pauwen]

Hello,

here is a document that relates to Karsten's remarks:

Note: Although all ACLs contain an implicit deny statement, Cisco recommends use of an explicit deny statement, for example, deny ip any any. On most platforms, such statements maintain a count of the number of denied packets. This count can be displayed using the show access-list command.

Check the link below for reference:

Cisco Firewall Best Practices Guide

https://www.cisco.com/c/en/us/about/security-center/firewall-best-practices.html

[Pravin Raj Kanagaraj]

Thank you Georg,

So I assume from your comments that  "access-list outside line 38 extended deny ip any any (Last Line)"

is enough to block any traffic that comes to outside interface.

[Karsten Iwen · Accepted solution]

Yes, "ip" includes all ip-based protocols. You don't need udp and tcp in addition to that. But with your ACL you'll see separate statistics for udp and tcp which could be desired.

[Pravin Raj Kanagaraj]

Thank you so much, got the desired answer.