cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1393
Views
5
Helpful
2
Replies

ASA firewall policy script

JoshBar75473
Beginner
Beginner

Configure a Cisco ASA firewall policy that filters traffic between source and destination. ASA with 2 interfaces and a PC on each segment. 

  • Inside network is 192.168.1.0/24.  Outside network is 10.10.10.0/24.  
  • Create a network object group for each segment.
  • Create a firewall policy that permits ICMP from source inside network to destination outside network.

 

1 Accepted Solution

Accepted Solutions

paul driver
VIP Expert VIP Expert
VIP Expert

Hello
By default in ASA icmp reply from a lower level interface isnt allowed so you need to either allow them in the global_policy  policy map or create a acl to allow them, And as you have stated you wish to use objects for both source/destination subnets the acl is what is required.

object network LAN
subnet 192.168.1.0 255.255.255.0

object network WAN
subnet 10.10.10.0 255.255.255.0

access-list 100 extended permit icmp object WAN object LAN echo-reply
access-group 100 in interface outside <--replace with the interface name of your wan interface

 

Note: The above acl will ONLY allow return traffic from the subnets specified in the network objects


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

View solution in original post

2 Replies 2

JoshBar75473
Beginner
Beginner

Thank You!

paul driver
VIP Expert VIP Expert
VIP Expert

Hello
By default in ASA icmp reply from a lower level interface isnt allowed so you need to either allow them in the global_policy  policy map or create a acl to allow them, And as you have stated you wish to use objects for both source/destination subnets the acl is what is required.

object network LAN
subnet 192.168.1.0 255.255.255.0

object network WAN
subnet 10.10.10.0 255.255.255.0

access-list 100 extended permit icmp object WAN object LAN echo-reply
access-group 100 in interface outside <--replace with the interface name of your wan interface

 

Note: The above acl will ONLY allow return traffic from the subnets specified in the network objects


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers