I have set up the following network: enter image description here

My goal is to allow connections to be initiated from the computer on the right (Host 2) to the computer on the left (Host 1). I also want Host 1 to be unable to initiate connections. Finally, I want Host 1 to be unable to send inbound traffic.

Very simple ACL's:

access-list 101 line 1 extended permit tcp any any
access-list 101 line 2 extended deny ip any any
access-list 102 line 1 extended deny ip any any
  • ACL 101 - applied to inbound traffic of the right side of the ASA
  • ACL 102 - applied to inbound traffic of the left side of the ASA

Using NetCat, I was able to forge a connection from Host 2 to Host 1 with no problem and am denied, as intended, from initiating the connection from Host 1 to Host 2: enter image description here

As you can see, sending it from the Host 2 (white screen) to Host 1 (black screen) creates the FW flag UO (TCP handshake completed and outbound traffic). Now, When I send traffic from the black terminal to the white terminal, it changes the FW flag to "UIO" (outbound and inbound traffic).

enter image description here

What I want is to block incoming traffic from Host 1 while keeping the connection established and allowing outbound traffic. How can I accomplish this?


  • Also, am I able to drop packets with a specific TCP flag? (i.e. PSH)? – Goodies Jan 19 '15 at 22:28
  • This configuration will not function as intended with the access list you have created. You must construct your access list to specify exactly the source and destination IPs (or networks) to which you wish to allow or deny traffic - in this case, Host 1 and Host 2. Specifying "any" will result in configuration nonfunctionality. – Panther Modern Jan 19 '15 at 23:05
  • Yes, thank you. This is merely a test virtual network whose functionality will be deployed on a real network later on. It seems to function as intended thus far, but I'd really like to do some sort of stateful filtering. Firstly, do you know of a way to filter by TCP flag? I want to see what happens when I drop incoming TCP packets with a PSH flag. – Goodies Jan 19 '15 at 23:13
  • 1
    Unfortunately, you can't create ACLs on the ASA that filter on TCP flags – Ron Trunk Jan 19 '15 at 23:18
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 2:58

You must construct your access list(s) in a a fashion which explicitly targets the traffic and / or hosts you wish to permit or deny, in this case, Host 1 and Host 2.


(config)# access-list 101 extended permit ip [host2] [host1] any
(config)# access-list 101 extended deny ip [host1] any log
(config)# access-list 101 extended permit ip any any

NOTE: The final line is required if you wish any other traffic from the same network as Host 2 to be allowed outside your firewall: a silent, implicit deny exists at the end of every Cisco ACL.

Then, on the interface which first receives this traffic initiated by Host 2 (inside):

(config-if): ip access-group 101 in

With regards to your request that Host1 may not communicate with Host2 unless Host2 has already begun a session with Host1, this is the default nature of the Cisco ASA: it is a stateful packet-filter: connections which were not initiated from the inside zone will not be accepted when coming from the outside, unless rules configured by the Administrator explicitly permit them.

See the following guide for more details:


  • Thank you. This is a big help, but I believe there is a misunderstanding. The outside host is not able to initiate a connection and that is exactly what I want. However, when the inside host establishes a connection, there is a TCP tunnel that can send/receive data from either host. While this TCP stream is active, I want only Host 2 to send data to Host 1 – Goodies Jan 19 '15 at 23:20
  • TCP is a connection-oriented protocol, requiring bidirectional communication between hosts. What you're asking for is not technically or procedurally feasible. – Panther Modern Jan 19 '15 at 23:22
  • It must be. Let me ask you this. How does the ASA know when to flip the flag from UO to UIO? This occurs when the Host 1 sends data to Host 2 (that's not apart of the initial handshake). Do you know if it is possible to drop packets based on TCP flag? – Goodies Jan 19 '15 at 23:24
  • To re-iterate: TCP is a bidrectional protocol, requiring communication to and from each host to each other to function properly: without this functionality, the TCP handshake will not function, nor will acknowledgements. What you are asking for, from the TCP protocol, goes against the RFC. ietf.org/rfc/rfc793.txt – Panther Modern Jan 19 '15 at 23:27
  • 1
    I do not want a one-way TCP stream with no ACKs. I want a TCP stream that disallows TCP PSH packets on one interface. This is perfectly possible with a standard router ACL, so why can I not filter by TCP flag on an ASA? – Goodies Jan 19 '15 at 23:36

Configure the ASA so that the left side is the "outside" interface (low security level), and the right side is the inside interface (high security level). You do not need any access lists as the security zone mechanism of the ASA does exactly what you want, and traffic will be filtered in the manner you want.

You will have to address translation (or specify no translation) as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.