1

1) Why do we need to specifically deny ip xxxxx xxxxxxx, when at the end of every ACL statement, WHEN there is a default "deny any any" statement?

Meaning we just permit only what we need and let the default "deny any any" take care of the rest instead of stating permit xxxx and deny xxxxx along with the default "deny any any".

2) What is the difference between ACL in Router and Firewall ASA?

3) Does permit [IP] cover TCP/UDP?

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19 '18 at 20:23
1

1) Why do we need to specifically deny ip xxxxx xxxxxxx, when at the end of every ACL statement, there is a default "deny any any" statement?

You don't "need to."
Some reasons for doing so are it gives you hit counts when you type "show access-list x," and you can add the logging command (deny ip any any log).

2) What is the difference between ACL in Router and Firewall ASA?

The biggest difference is that routers use wildcard masks, while ASAs use normal masks.

3) Does permit [IP] cover TCP/UDP?

Yes, along with ICMP, ESP, OSPF and others.

3
  • lets say i want to prevent ICMP scanning, meaning i do not need to write "deny icmp any any echo" "timestamp-request" etc as the default deny ip any any will help me? Same goes for fragmentation attack (deny ip xxxx xxxx fragments) ?
    – Joal
    Nov 29 '17 at 16:09
  • Anything that wasn't permitted in a previous entry is denied.
    – Ron Trunk
    Nov 29 '17 at 16:11
  • oh i see... so by explicitly stating deny xxx xxx is just for logging purposes...
    – Joal
    Nov 29 '17 at 16:12
0

Additionally for 1)

deny entries allow for much easier structuring. Suppose you want to permit a single user/IP <src> SSH access to another subnet <dest> while denying all other SSH:

permit tcp <src> <dest> eq 22
deny tcp any <dest> eq 22
...

Without deny you'd have to construct awkward allow entries around the source IP.

-1

Firewalls do stateful inspection

1
  • Your answer was flagged as low quality. You should expand your answer to explain better, and include any supporting documentation.
    – Ron Maupin
    Nov 29 '17 at 16:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.