3

I am reviewing one of the Cisco ASA configurations and not able to understand the 2nd line with ACL:

access-list ABC extended permit tcp any host P.Q.R.S eq www //
access-list DEF extended permit tcp host P.Q.R.S eq www any

My question is:

I am not using here NAT for the IP P.Q.R.S, also there is no need of reverse route for service www, as it will maintain the state, then whey they have allowed traffic from source port www?

It is mistake, or if it is right, why it is needed?

  • Just pay attention when you say "reverse route". Reverse route means that the server's routing table contains the client's network and this is necessary for a communication. I guess you were referring to "flow". – radtrentasei Oct 1 '13 at 7:41
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 14:36
2

It depends on the interface's security-level. ASA keeps track of a connection. There is no need of the 2nd ACL.

  • By default the ASA perform stateful inspection. – radtrentasei Oct 1 '13 at 13:38
1

Since the first ACL is named ABC and the second ACL is named DEF, they are obviously used differently in the configuration. Since you don't specify how those two ACLs are applied, we can only guess.

Take the following scenario: the first access-list is applied inbound on the inside interface. There is a VPN tunnel on the outside that causes the traffic to be encrypted and sent off to a business partner. The business partner is not exactly trust-worthy, so you want to protect yourself from them. So you apply the second ACL to the VPN tunnel in the inbound direction (the only direction in which you can filter a VPN tunnel). Therefore, this ensures that the business partner can not initiate any traffic to your network that did not originate from within your network first. (The reason this extra step is necessary is because the default behavior of an ASA firewall is that any successfully decrypted traffic is treated as though it were at security level 100.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.