2

I'm having some trouble with Access Rules on a Cisco ASA 5525. The rule I want the ASA to use is the following:

 access-list global_access line 1 extended permit ip range 192.168.1.3 
  192.168.1.233 interface net (hitcnt=0) 0xcc058868

The rule which is used instead is this one:

access-list global_access line 22 extended deny ip 192.168.1.64 
 255.255.255.192 any (hitcnt=54) 0x15d9372b

An example log entry for the latter rule:

4   Mar 07 2018 15:07:13    106023  192.168.1.89    53320   --public DNS server--   53  Deny udp src mais:192.168.1.89/53320 dst net:--public DNS server--/53 by access-group "global_access" [0x966f215f, 0x15d9372b]

The destination obviously is on interface net so I have no clue why this isn't working. --public DNS server-- is a public IP address outside any configured network range.

If I use any instead of net in rule 1 everything works as intended, except that I don't want to use any.

Improve this question
8
  • It would help to have more explicit information on your interfaces and and your intent. I can guess: 1) You're trying to allow inside hosts in that 192.168.1.x range to reach the internet. 2) 'net' is the name of your outside (least trusted) interface. Does flipping 'net' to your inside interface instead work?
    – boomi
    Mar 7, 2018 at 23:22
  • Actually, disregard that suggestion. I misread the syntax, when you specify an 'interface' in the ACL command that's a stand-in for the source or destination IP of that interface.
    – boomi
    Mar 7, 2018 at 23:37
  • 1) Yes, that's correct. 2) That's correct as well. I tried with all the interfaces as destination but the rule is only applied if I set it to any.
    – chris137
    Mar 8, 2018 at 15:38
  • So as I alluded to in the other comment, that 'interface <int>' syntax in your ACL is saying "if the packet is destined to this interface address" not "if the packet is destined to an address reached out of this interface". Since 'any' implies any destination address, it works. It sounds like the bigger issue is why are you opposed to using 'any' here for internet access? If you want to ensure those hosts aren't getting to other internal networks, I would consider denying that range under the appropriate interface ACL's.
    – boomi
    Mar 8, 2018 at 23:02
  • Ah, that makes sense, thank you! My main issue here is that I was under the impression that this worked before I made some changes to the rules. Drove me nuts this week. I'll look into using interface ACLs instead of the global ones. It's probably the more fancy way to do it anways.
    – chris137
    Mar 9, 2018 at 7:20

1 Answer 1

Reset to default
1

My mistake was indeed a misunderstanding of the syntax, as pointed out in the comments above. I now switched over to using interface ACLs instead of just global ACLs which is probably the intended way anyways.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.