Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Cisco ASA 5510 Firewall Rules

Posted on 2009-04-06
6
Medium Priority
?
1,314 Views
Last Modified: 2013-11-22
I have a Cisco 5510 firewall and need some advice on configuration. I have plenty of protection for outside coming in, but only the two implicit default rules for inside going out.  I played around with blocking IP addresses from accessing the internet and succeeded, but obviously the implicit rules go away and I need to create an allow any any in order for it to work. Is the allow any any the SAME as the implicit allow any to any lesser secured network?  I would love to block a whole chunk of IP's from accessing the outside world, but I don't want to create security holes in the process.  Also, what are some ideas for other rules for my users going to the outside world. It seems like having these two default rules still won't protect a user from establishing a cummunication to an unwanted source.  One last question, there is an option for direction for each inside and outside rule sets, could I have an example in which you would utilize this?
0
Comment
Question by:dennisjameshoward
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 43

Expert Comment

by:JFrederick29
ID: 24076761
The "permit ip any any" is the same as the implicit permit any.  They both provide the same functionality.

>Also, what are some ideas for other rules for my users going to the outside world. It seems like having these two default rules still won't protect a user from establishing a cummunication to an unwanted source.

I prefer to whitelist certain ports that users are allowed to access.  This should help against P2P and other applications that are undesired.  Adding a proxy server with content filtering is a nice addition to protect users from visiting malicious sites but this is in addition to the Firewall itself.

>One last question, there is an option for direction for each inside and outside rule sets, could I have an example in which you would utilize this?

You could apply an access-list outbound on the inside interface if you had a number of DMZ's on the Firewall and wanted to add a second level of protection from DMZ to inside.

For example:

If you allowed your DMZ hosts HTTP access to "any" destination, this would allow HTTP to the inside hosts as well from the DMZ.  You can make sure you put a deny to the inside subnets prior to the HTTP any rule in the DMZ access-list or you can use the outbound list on the inside to negate "misconfigurations".
0
 
LVL 10

Expert Comment

by:atlas_shuddered
ID: 24079282
Jfred - I'd like to add a couple of things, sorry if it steps on your answer.

dennis -
In regards to the in and out rules, in your example, the traffic from DMZ to Inside would be denied implicitly, if, the security level on the Inside is higher than that of the DMZ.  In that case, an inbound rule would have to be set on the Inside interface to allow the traffic in.  The reasoning for in and outbound rules you list I agree with but the use is more intentional, conditioned on the security level of the interfaces interacting.  Each ruleset (inside/outside/dmz and in/out) is applied independently without regard to any previous rules the traffic may have encountered.  The caveat, any any rules work best with traffic moving from a higher interface to a lower and are best left out of the mix when moving from lower to higher.

Beyond this, when looking at your rulesets approach them from the perspective of using inbound rules to deny traffic being unnecessarily processed.  In other words, identify the objects/ports/protocols that you want to allow and then kill everything else with deny any any log.  This way, what has to go can and what isn't going is killed prior to being processed.  The logging will help you with troubleshooting.  Regarding the interface out rules, use these as your filters/leak guards and traffic controls in response to any any or broad allow statements on other, higher security levelled interfaces.

Beyond this, utilizing the proxy can be a good idea, however, it may be worthwhile to consider licensing the content filtering abilities on the ASA itself.  Another item of interest I have seen recently is OpenDNS, a free DNS service which you can sub in for your outside/ISP resolvers.  You may want to check this out as well and see if it will work for you.

Hope it helps

Cheers
0
 

Author Comment

by:dennisjameshoward
ID: 24086604
So basically if I were to deny one ip address and allow any any,  this will be the EXACTLY same as the implicit allow to any lesser network, BUT with this one blocked IP?
0
Introducing the WatchGuard 420 Access Point

WatchGuard's newest access point includes an 802.11ac Wave 2 chipset, providing the fastest speeds for VoIP, video and music streaming, and large data file transfers. Additionally, enjoy the benefits of strong security as the 3rd radio delivers dedicated WIPS protection!

 
LVL 43

Expert Comment

by:JFrederick29
ID: 24086663
Yes.  Correct.
0
 

Author Comment

by:dennisjameshoward
ID: 24086854
Thanks,  it made me nervous because testing this, I saw tons of hits for the allow any any rule, and before with the implicit i saw none.  The hits must not show for the default, but they ARE really there
0
 
LVL 43

Accepted Solution

by:
JFrederick29 earned 2000 total points
ID: 24086947
Correct again.  You will see hits on the explicit permit ip any any rule but they aren't visible for the implicit permit rule.  Functionally they are the same.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
This article investigates the question of whether a computer can really be cleaned once it has been infected, and what the best ways of cleaning a computer might be (in this author's opinion).
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

660 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question