Using access list instead of conduit

lpryce · ‎10-05-2001

My Pix 506 is using conduit statements. Can I simply replace the conduit commands with access lists?

Thanks

wraights · ‎10-05-2001

if you know how to use acl's...what ios are you running?

cookm · ‎10-05-2001

Yes, your conduit statements can be replaced with access-list statements by reversing the order the source and destination are specified.

Bear in mind that unlike conduits, access-lists affect traffic from higher-to-lower security interfaces as well as lower-to-higher security interfaces, so you may need to add more entries to allow outbound access from dmz etc...

n.chestney-stagg · ‎10-05-2001

An excellent comment ! A problem that a lot of people forget before they implement. I knew of a colleague who works for another company and he did not know that and made a mistake. Good point cookm