How to permit for nmap scan to ASA

[jewfcb001]

Hi All,

If need to nmap scan for security 
Can i some ACL command for permit nmap scan to ASA for tcp22/443.  
Ex.

access-list NMAPSCAN extended permit ip host <ip-nmap host> host <IP Interface Firewall>
access-group NMAPSCAN in interface <interface-name>

Is it enough ? 

[balaji.bandi]

below example should work for only port 22 and 443

access-list XXXX_access_in extended permit tcp host NMAPIP interface (INSIDE or OUTSIDE) eq https

access-list XXXX_access_in extended permit tcp host NMAPIP interface (INSIDE or OUTSIDE) eq ssh

[jewfcb001]

Thank you for answer . 

Can I use this command ? Is it the result same your answer above ?
access-list NMAPSCAN extended permit ip host <ip-nmap host> host <IP Interface Firewall>

[MHM Cisco World]

Sure you can use this command.

This command allow all traffic (udp tcp and other) between two hosts.

But here the destiantion is FW interface not host connect to FW so 

Normal acl effect traffic between host through fw

Control plane acl effect traffic toward the FW interface.

So use acl but use access-group with control plane.

Note:- by defualt all fw dont have any control plane and you allow to connect it' try use nmap without acl' if you failed add this acl with control plane 

MHM

[jewfcb001]

Okay 
You mean use this one 
access-list NMAPSCAN extended permit ip host <ip-nmap host> host <IP Interface Firewall>
access-group NMAPSCAN in interface <interface-name>

or 

access-list XXXX_access_in extended permit tcp host NMAPIP interface (INSIDE or OUTSIDE) eq https
access-list XXXX_access_in extended permit tcp host NMAPIP interface (INSIDE or OUTSIDE) eq ssh
access-group  XXXX_access_in in interface <interface-name>

AM I corrcet?

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/217679-asa-access-control-list-configuration-ex.html

Check this guide 

Check acl to-the-box

MHM

[Marvin Rhoads]

For traffic to the firewall interface address, use a control-plane ACL.

Here is an extended example for FMC, FDM (and even ASA):

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221469-configure-control-plane-access-control-p.html