ASA access list query

suthomas1 · ‎12-07-2009

Hi,

I have certain rules in firewall as below:

acl servers_in line 1 extended permit tcp 192.168.100.2 255.255.255.252 host 10.83.0.2 eq 443
acl servers_in line 2 extended permit tcp 192.168.100.2 255.255.255.252 host 10.83.0.2 eq 445
acl servers_in line 3 deny ip 192.168.100.2 255.255.255.252 any

acl servers_in line 4 extended permit tcp 192.168.100.10 255.255.255.224 host 10.83.0.10 eq 25
acl servers_in line 5 extended permit tcp 192.168.100.10 255.255.255.224 host 10.83.0.11 eq 80
acl servers_in line 6 deny ip 192.168.100.10 255.255.255.224 any

acl servers_in line 7 permit ip 192.168.100.0 255.255.255.0 any

My goal is to restrict 192.168.100.2 /30 to only 10.83.0.2 on specific service. similar goes for the other from line 4-6.
& deny these 192.168.100.2 /30 & 192.168.100.10 255.255.255.224 from accessing anything else, which is why i
thought of putting deny after these.
however due to some other reasons, i cant do away with line 7.
With this i find restrictive lines 1-2 and 3-4 arent really working. whereas if i remove the deny it works properly(as it should).
Please help me to align & have proper rules in place so that i can stil restrict the groups to what they are required to.

Thank You.

busterswt · ‎12-07-2009

I'm sorta surprised that the firewall let you put in an ACL with a non-pairing IP/mask (192.168.100.2 255.255.255.252). When you specify the subnet mask the IP must be the network IP not a 'host' IP, unless the mask is /32. You might try the following:

acl servers_in line 1 extended permit tcp host 192.168.100.2 host 10.83.0.2 eq 443
acl servers_in line 2 extended permit tcp host 192.168.100.2 host 10.83.0.2 eq 445
acl servers_in line 3 extended deny ip host 192.168.100.2 any

acl servers_in line 4 extended permit tcp host 192.168.100.10 host 10.83.0.10 eq 25
acl servers_in line 5 extended permit tcp host 192.168.100.10 host 10.83.0.11 eq 80
acl servers_in line 6 extended deny ip host 192.168.100.10 any

acl servers_in line 7 extended permit ip 192.168.100.0 255.255.255.0 any

Good luck!

James

suthomas1 · ‎12-07-2009

Apologies, my mistake.

It is infact 192.168.100.0 255.255.255.252

With these networks of hosts involved, i believe the acls wont work as required.

Please suggest.

Panos Kampanakis · ‎12-08-2009

acl servers_in line 1 extended permit tcp 192.168.100.0 255.255.255.252 host 10.83.0.2 eq 443
acl servers_in line 2 extended permit tcp 192.168.100.0 255.255.255.252 host 10.83.0.2 eq 445
acl servers_in line 3 deny ip 192.168.100.2 255.255.255.252 any

acl servers_in line 4 extended permit 192.168.100.0 255.255.255.224 host 10.83.0.10 eq 25
acl servers_in line 5 extended permit 192.168.100.0 255.255.255.224 host 10.83.0.11 eq 80
acl servers_in line 6 deny ip 192.168.100.10 255.255.255.224 any

will ONLY allow 192.168.100.1 and .2 going to 10.83.0.2 on ports 443 and 445.
And ONLY 192.168.100.1 up to .30 going to 10.83.0.10 and .11 on ports 25 and 80 respectively.

Are those only what you want to allow?

I hope it helps.

PK