A customer sent me this config and asked if I would review it.
nameif vlan246 test security50
!
access-list test_I_O extended permit ip any object-group test_destination_nets
access-list test_I_O extended permit ip any any
access-list test_I_O extended deny ip any any
!
access-group test_I_O in interface test
object-group test_destination_nets is a bunch of address ranges.
I'm fairly new to the whole FW thing but it seems to me that the permit ip any any over-rides the first permit statement and also the last deny statement is not necessary since there is an implicit deny at the end of all access-lists.
Am I thinking correctly?
