I am after a general consensus on permit ip any any, is this command ever acceptable ?
A PCI audit has just taken place on our network and a permit ip any any was found, since then all hell has broken lose. Please see below explanation for the design.
Our Network is based on a multi tier approach, which is based on the following.
LAN – Access Lists applied to the layer three SVI’s. the purpose of this ACL is to control LAN based traffic for example access to DC’s, ISA, Exchange etc. at the end of this ACL under the deny to anything LAN, is an IP any any, this permits access destined to anything not internal in LAN, this is then filtered at the Inner ASA.
Inner ASA – Most restrictive Access lists are placed at this layer on the inside, outside thrid party and DMZ interfaces. This controls access from LAN to External based connections such as the Internet and MPLS connections. We also control what traffic can come in from the outside in terms of VPN’s. This layer is treated as our strongest layer of traffic control.
Outer ASA – Due to the restrictive filtering on the Inner ASA, we trust the traffic that is sourced from the inside network as it has already been filtered by the Inner layer. The main purpose of the Outer layer is to be a termination point for VPN’s and control traffic that is connecting from the Internet towards the servers that are in the DMZ. To secure further we also NAT to a completely separate private range on the Outer Layer for anything that is accessible from the Internet.
Each layer of Firewalls have a distinct purpose as by design and I feel they are performing in an efficient way to provide a high level of data throughput.
The ip any any is actually by design and has been placed on the Outer ASA's inside interface, the thought process behind this is mainly for supportability in terms of making changes etc, as i do not see the benefit of replicating the rule base from my Inner to my Outer, as this in theory would be the same as an ip any any as it is only possible for my inside network to traverse this interface.
Any comments would be greatly appreciated.
Again, this is not Cisco official statement (I don't have this power) .
One can argue that a firewall sandwitch is probably not the best design in the best place :-)
However I do not see anything wrong with having permit on inside in case of firewall sandwich