| Copyright (c) 2008 Don R. Crawley | | | | destination port 443. Notice in the output of the show |
| Access Control Lists (ACLs) are sequential lists of | | | | access-list that line numbers are displayed and the |
| permit and deny conditions applied to traffic flows on a | | | | extended parameter is also included, even though |
| device interface. ACLs are based on various criteria | | | | neither was included in the configuration statements. |
| including protocol type source IP address, destination IP | | | | You can deactivate an ACE without deleting it by |
| address, source port number, and/or destination port | | | | appending the inactive option to the end of the line. |
| number. | | | | As with Cisco routers, there is an implicit "deny any" at |
| ACLs can be used to filter traffic for various purposes | | | | the end of every ACL. Any traffic that is not explicitly |
| including security, monitoring, route selection, and | | | | permitted is implicitly denied. |
| network address translation. ACLs are comprised of | | | | **Editing ACLs and ACEs** |
| one or more Access Control Entries (ACEs). Each | | | | New ACEs are appended to the end of the ACL. If |
| ACE is an individual line within an ACL. | | | | you want, however, to insert the new ACE at a |
| ACLs on a Cisco ASA Security Appliance (or a PIX | | | | particular location within the ACL, you can add the line |
| firewall running software version 7.x or later) are similar | | | | number parameter to the ACE:asa04(config)# |
| to those on a Cisco router, but not identical. Firewalls | | | | access-list demo1 line 1 deny tcp host 10.1.0.2 any eq |
| use real subnet masks instead of the inverted mask | | | | wwwasa04(config)# show access-list |
| used on a router. ACLs on a firewall are always | | | | demo1access-list demo1; 3 elementsaccess-list demo1 |
| named instead of numbered and are assumed to be | | | | line 1 extended deny tcp host 10.1.0.2 any eq |
| an extended list. | | | | wwwaccess-list demo1 line 2 extended permit tcp |
| The syntax of an ACE is relatively straight-forward: | | | | 10.1.0.0 255.255.255.0 any eq wwwaccess-list demo1 |
| Ciscoasa(config)#access-list name [line number] | | | | line 3 extended permit tcp 10.1.0.0 255.255.255.0 any eq |
| [extended] {permit | deny} protocol source_IP_address | | | | https |
| source_netmask [operator source_port] | | | | Notice in the first line of the example above that an |
| destination_IP_address destination_netmask [operator | | | | ACE is added at line one in the ACL. Notice in the |
| destination_port] [log [[disable | default] | [level]] [interval | | | | output from the show access-list demo1 command |
| seconds]] [time-range name] [inactive] | | | | that the new entry is added in the first position in the |
| Here's an example:asa(config)# access-list demo1 | | | | ACL and the former first entry becomes line number |
| permit tcp 10.1.0.0 255.255.255.0 any eq | | | | two. |
| wwwasa(config)# access-list demo1 permit tcp 10.1.0.0 | | | | You can remove an ACE from an ACL by preceding |
| 255.255.255.0 any eq 443asa(config)# show | | | | the ACE configuration statement with the modifier no, |
| access-list demo1access-list demo1; 2 | | | | as in the following example: |
| elementsaccess-list demo1 line 1 extended permit tcp | | | | Asa04(config)#no access-list demo1 deny tcp host |
| 10.1.0.0 255.255.255.0 any eq wwwaccess-list demo1 | | | | 10.10.2 any eq www |
| line 2 extended permit tcp 10.1.0.0 255.255.255.0 any eq | | | | In my next article, I'll show you how to use time-ranges |
| https | | | | to apply access-control lists only at certain times and |
| In the above example, an ACL called "demo1" is | | | | or on certain days. I'll also show you how to use |
| created in which the first ACE permits TCP traffic | | | | object-groups with access-control lists to simplify ACL |
| originating on the 10.1.0.0 subnet to go to any destination | | | | management by grouping similar components such as |
| IP address with the destination port of 80 (www). In | | | | IP addresses or protocols together. |
| the second ACE, the same traffic flow is permitted for | | | | |