| Copyright (c) 2008 Don R. Crawley | | | | destination port 443. Notice in the output |
| | | | of the show access-list that line numbers are |
| Access Control Lists (ACLs) are sequential | | | | displayed and the extended parameter is also |
| lists of permit and deny conditions applied | | | | included, even though neither was included in |
| to traffic flows on a device interface. ACLs | | | | the configuration statements. |
| are based on various criteria including | | | | |
| protocol type source IP address, destination | | | | You can deactivate an ACE without deleting it |
| IP address, source port number, and/or | | | | by appending the inactive option to the end |
| destination port number. | | | | of the line. |
| | | | |
| ACLs can be used to filter traffic for | | | | As with Cisco routers, there is an implicit |
| various purposes including security, | | | | "deny any" at the end of every ACL. Any |
| monitoring, route selection, and network | | | | traffic that is not explicitly permitted is |
| address translation. ACLs are comprised of | | | | implicitly denied. |
| one or more Access Control Entries (ACEs). | | | | |
| Each ACE is an individual line within an ACL. | | | | **Editing ACLs and ACEs** |
| | | | |
| ACLs on a Cisco ASA Security Appliance (or a | | | | New ACEs are appended to the end of the ACL. |
| PIX firewall running software version 7.x or | | | | If you want, however, to insert the new ACE |
| later) are similar to those on a Cisco | | | | at a particular location within the ACL, you |
| router, but not identical. Firewalls use | | | | can add the line number parameter to the |
| real subnet masks instead of the inverted | | | | ACE:asa04(config)# access-list demo1 line 1 |
| mask used on a router. ACLs on a firewall | | | | deny tcp host 10.1.0.2 any eq |
| are always named instead of numbered and are | | | | wwwasa04(config)# show access-list |
| assumed to be an extended list. | | | | demo1access-list demo1; 3 elementsaccess-list |
| | | | demo1 line 1 extended deny tcp host 10.1.0.2 |
| The syntax of an ACE is relatively | | | | any eq wwwaccess-list demo1 line 2 extended |
| straight-forward: | | | | permit tcp 10.1.0.0 255.255.255.0 any eq |
| | | | wwwaccess-list demo1 line 3 extended permit |
| Ciscoasa(config)#access-list name [line | | | | tcp 10.1.0.0 255.255.255.0 any eq https |
| number] [extended] {permit | deny} protocol | | | | |
| source_IP_address source_netmask [operator | | | | Notice in the first line of the example above |
| source_port] destination_IP_address | | | | that an ACE is added at line one in the ACL. |
| destination_netmask [operator | | | | Notice in the output from the show |
| destination_port] [log [[disable | default] | | | | | access-list demo1 command that the new entry |
| [level]] [interval seconds]] [time-range | | | | is added in the first position in the ACL and |
| name] [inactive] | | | | the former first entry becomes line number |
| | | | two. |
| Here's an example:asa(config)# access-list | | | | |
| demo1 permit tcp 10.1.0.0 255.255.255.0 any | | | | You can remove an ACE from an ACL by |
| eq wwwasa(config)# access-list demo1 permit | | | | preceding the ACE configuration statement |
| tcp 10.1.0.0 255.255.255.0 any eq | | | | with the modifier no, as in the following |
| 443asa(config)# show access-list | | | | example: |
| demo1access-list demo1; 2 elementsaccess-list | | | | |
| demo1 line 1 extended permit tcp 10.1.0.0 | | | | Asa04(config)#no access-list demo1 deny tcp |
| 255.255.255.0 any eq wwwaccess-list demo1 | | | | host 10.10.2 any eq www |
| line 2 extended permit tcp 10.1.0.0 | | | | |
| 255.255.255.0 any eq https | | | | In my next article, I'll show you how to use |
| | | | time-ranges to apply access-control lists |
| In the above example, an ACL called "demo1" | | | | only at certain times and/or on certain days. |
| is created in which the first ACE permits TCP | | | | I'll also show you how to use object-groups |
| traffic originating on the 10.1.0.0 subnet to | | | | with access-control lists to simplify ACL |
| go to any destination IP address with the | | | | management by grouping similar components |
| destination port of 80 (www). In the second | | | | such as IP addresses or protocols together. |
| ACE, the same traffic flow is permitted for | | | | |