Solved

ASA 5510 - Question about ACL configuration

Posted on 2009-04-02
1
632 Views
Last Modified: 2012-05-06
I have an ASA 5510 and would like to fine tune the ACL's on the device.

The interface and security levels are as follows

Outside / 0
Inside / 100
Production / 100

I have allowed same level security traffic flow on the device and want to restrict most traffic between the two internal networks.

For instance I currently have this statement on the inside interface.

access-list 102 line 18 extended permit tcp any any eq www

I just want that ACL to allow HTTP traffic to the outside interface (internet). However when I change the destination from ANY to the outside interface, or the outside network, web traffic is blocked.

Is this possible... or do I need to specify a deny statement  before that example ACL that would block HTTP traffic to the Production network.

Or to put the question differently. what is the proper way to configure the destination for external networks without using the any statement in the ACL




0
Comment
Question by:Highspade
1 Comment
 
LVL 33

Accepted Solution

by:
MikeKane earned 500 total points
ID: 24052788
If I understood, you want the INSIDE network to have www access to the OUTSIDE but not to PRODUCTION.  

If that is correct, then you are right in your assumption.

Your acl should look something like this:

acl inside_access_out extended deny tcp <inside-subnet> <inside-subnet-netmask> <production-subnet> <production-subnet-netmask> eq www
acl inside_access_out extended permit tcp <inside-subnet> <inside-subnet-netmask> any eq www


The ACL's are read top to bottom and processing stops once there is a match.   So this acl would match the www request from inside to production and deny it, processing stops.   The next line allows for www to any address with the assumption that the production subnet would have been denied already if it matched.  

This could be simplified by:

acl inside_access_out extended deny ip <inside-subnet> <inside-subnet-netmask> <production-subnet> <production-subnet-netmask>
acl inside_access_out extended permit ip <inside-subnet> <inside-subnet-netmask> any

This one blocks all ip from inside to production, and then allows all ip everywhere else.  


This acl works if you use
access-group inside_access_out in interface inside





0

Featured Post

Surfing Is Meant To Be Done Outdoors

Featuring its rugged IP67 compliant exterior and delivering broad, fast, and reliable Wi-Fi coverage, the AP322 is the ideal solution for the outdoors. Manage this AP with either a Firebox as a gateway controller, or with the Wi-Fi Cloud for an expanded set of management features

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question