i have changed access-list from in to out, so now i can not access from outside to inside, but have no limits from inside((( is that possible whith access-group inside_access_in in interface inside close target port 3389 in the inside network? ... View more

my test config: GUESS# sh run : Saved : ASA Version 8.0(4) ! hostname GUESS enable password cisco encrypted passwd cisco encrypted names name 10.255.0.2 routerX name 10.1.7.73 LaptevValery ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 9.18.2.2 255.255.255.128 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.255.0.1 255.255.255.248 ! interface GigabitEthernet0/2 no nameif no security-level no ip address !             interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 shutdown no nameif no security-level no ip address management-only ! boot system disk0:/asa804-k8.bin boot system disk0:/asa805-k8.bin ftp mode passive object-group network HTTP_Access network-object LaptevValery 255.255.255.255 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service DM_INLINE_TCP_1 tcp port-object eq ftp access-list inside_access_in extended permit tcp any any eq 3389 access-list inside_access_in extended permit tcp any eq ftp any inactive access-list inside_access_in extended permit tcp any gt 1023 any inactive access-list inside_access_in extended permit ip any any inactive access-list outside_access_in extended permit ip any any access-list dmz_access_in extended permit tcp any object-group DM_INLINE_TCP_1 any pager lines 24 mtu outside 1500 mtu inside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-615.bin no asdm history enable arp timeout 14400 static (inside,outside) 9.18.2.73 LaptevValery netmask 255.255.255.255 static (inside,outside) 9.18.2.72 routerX netmask 255.255.255.255 access-group outside_access_in in interface outside access-group inside_access_in in interface inside route outside 0.0.0.0 0.0.0.0 9.18.2.1 1 route inside 10.0.0.0 255.0.0.0 RouterX 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute dynamic-access-policy-record DfltAccessPolicy http server enable http LaptevValery 255.255.255.255 inside http RouterX 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet LaptevValery 255.255.255.255 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept username cisco password cisco encrypted ! class-map inspection_default match default-inspection-traffic !             ! policy-map type inspect dns preset_dns_map parameters   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ftp strict   inspect http ! service-policy global_policy global prompt hostname context Cryptochecksum:6e3bfe5e3a4083aa25847a7cc90e0147 : end GUESS# whith this config i can sucsesfuly conect whith radmin(4899) to 9.18.2.73 from 9.18.2.1 or 10.18.2.1 that is somthing that i really need to fix. ... View more

to pkampana: I have allready done this: If you want to limit inside to outside and dmz then you can do it with an inside ACL. You know what the dmz subnet is. So you allow what you need on the inside for traffic that is destined to the dmz and you allow whast you need for the rest (to outside). on inside interface access-list to in. from inside interface every single connection is filtered just fine, but if some one trying to connect from outside to inside, i have no hits to my access-list and all connection is permited. I see hits on the outside interface access-list which is permit ip any any. Is it fine that inside_in access list does not filter connections from outside to inside? or it is impossible to filter both out and in connections whiyh 1 access-list? to August Ritchie: now i will try to use inside_out access-list, but it seems to not filter connection from inside to outside. ... View more

thank you for reply* no, that does not answer my question(sory) I understand how 1 Acl work. but how does it work if 2 ACL on 2 different interfaces? I need to protect my inside from outside and dmz, dmz2, dmz3 ... I would like to put ACL on inside interface. because if i put it on outside interface, i will need extra ACL on each dmz, that will increase complexity of administrating network my problem is that ACL on inside interface(in) does not work for connections from outside.... may be there are some special check box to fix it.. ... View more