Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
430
Views
0
Helpful
10
Replies

Does applying ACE's to VPN's on ASA slow the VPN down slightly?

whiteford
Level 1
Level 1

‎06-18-2008 01:30 AM - edited ‎03-11-2019 06:00 AM

Hi,

I have a Cisco ASA and a test site-to-site VPN and a test Cisco client VPN coming into it. I had a rule which was just allow any any before on the outside interface to the inbound interface where the servers are. But have now added many many rules to lockdown what users on the VPN can get to so just the servers and their ports required are open.

Can this slow down the connection response to the user?

Thanks

Labels:
0 Helpful
10 Replies 10

Fernando_Meza
Level 7
Level 7

‎06-18-2008 02:07 AM

Hi,

Assuming your entries are configured in an efficient way i.e making sure the most matching rules are at the top of the access list, there are no entries logging events unless you really need it, using group objects whenever applicable .. etc. It is most likely that the user will not even notice the difference. The approach you had followed is the correct from a security perspective.

I hope it helps .. please rate helpfull posts

0 Helpful

whiteford
Level 1
Level 1
In response to Fernando_Meza

‎06-18-2008 02:58 AM

Thanks, so it might be best I move the ACE's to the top of the outside list? I have about 15 and I can simply use the ASDM to do this?

Thanks

0 Helpful

Farrukh Haroon
VIP Alumni
VIP Alumni
In response to whiteford

‎06-18-2008 03:11 AM

It is a best practice to put ACEs for frequently occuring traffic like management traffic (routing,snmp etc) at the top of ACLs. I think this should be doable in ASDM.

Regards

Farrukh

0 Helpful

whiteford
Level 1
Level 1
In response to Farrukh Haroon

‎06-18-2008 03:15 AM

Great there is a nice copy and paste function in the ADSL :)

0 Helpful

whiteford
Level 1
Level 1
In response to Fernando_Meza

‎06-18-2008 05:46 AM

THanks guys, how can I also tell if the rules are being logged?

0 Helpful

Farrukh Haroon
VIP Alumni
VIP Alumni
In response to whiteford

‎06-18-2008 06:15 AM

on the CLI you can use

show access-list

ASDM also has a similar field I think (8.x even has a real time one AFAIR).

Regards

Farrukh

0 Helpful

whiteford
Level 1
Level 1
In response to Farrukh Haroon

‎06-18-2008 06:38 AM

I did a sh access-list - should there simply be a "log" at the end of each ACE?

0 Helpful

Farrukh Haroon
VIP Alumni
VIP Alumni
In response to whiteford

‎06-18-2008 06:40 AM

The 'show access-list' will show you a hitcount irrespective of the 'log' keyword.

The log keyword goes one step further to generate syslogs whenever the ACE is matched.

Regards

Farrukh

0 Helpful

whiteford
Level 1
Level 1
In response to Farrukh Haroon

‎06-18-2008 06:42 AM

Hi Happs, I am getting hit counts, just popped onto the ASDM.

0 Helpful

Farrukh Haroon
VIP Alumni
VIP Alumni

‎06-18-2008 02:54 AM

This limited ammount of filtering should not cause any performance issues.

Regards

Farrukh

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents
Review Cisco Networking products for a $25 gift card