Menu

US Region

Grandmetric LLC
Brookfield Place Office
200 Vesey Street
New York, NY 10281
EIN: 98-1615498
Phone: +1 302 691 94 10

info@grandmetric.com

EMEA Region

GRANDMETRIC Sp. z o.o.
ul. Metalowa 5, 60-118 Poznań, Poland
NIP 7792433527
+48 61 271 04 43
info@grandmetric.com

Cisco ASA: ACL

Design & Configure

Cisco ASA: ACL

Technology: FIREWALLS

Area: Traffic restrictions

Vendor: CISCO

Software: CISCO ADAPTIVE SECURITY APPLIANCE (ASA) , ASA-OS, 8.3+

Platform: CISCO ASA 5500, 5500-X

 

ACL in ASA is similar to router configuration, except for processing and mask definition (where router uses wildcards). Adaptive security algorithm inspects only first packet belonging to particular session. Consecutive packets are “known” to ASA and are switched to “Fast Path” to not utilize ASA resources. ACLs are used to restrict or to permit traffic when there is a need to have transmission initiated from lower to higher security level interface. There is only one ACL on one interface in particular direction permission.

 

ASA_ACL

 

To configure ACL to allow connection to host 172.16.1.2 use command below:

access-list outside_in extended permit ip any host 172.16.1.2
access-group outside_in in interface outside

Note: in ASA-OS versions after 8.3 when using NAT, there is a rule to pointing the real destination address, in our case 172.16.1.2 instead of mapped IP like in older versions

 

Useful verification commands:

ASA2# show run access-list
ASA2# show access-list

Author: Marcin Bialy
 
Grandmetric