Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

ACL: Use of private inside IPs in the Internet facing ACL

I have not yet caught up to speed on ASA 8.3 changes and came across the below working ACL on an ASA running 8.3.  The ACL is applied inbound to an Internet facing publicly addressed interface.  At this point the destination IP in the packet will not be 192.168.0.41 but the ASA outside public IP.  My understanding was that ACL's were processed firstly then NAT.  The fact that this rule works implies things have changed?

access-list OUTSIDE_ACCESS_IN extended permit tcp any host 192.168.0.41 eq 54321

Regards,

Kent.

Everyone's tags (7)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

ACL: Use of private inside IPs in the Internet facing ACL

Here is the release notes for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.html#wp460665

(check out: Firewall Features section: Use of Real IP addresses in access lists instead of translated addresses)

3 REPLIES
Cisco Employee

ACL: Use of private inside IPs in the Internet facing ACL

Absolutely correct.

From version 8.3 and later, ACL has changed where by ACL applied inbound on the Internet facing interface will have destination of the real IP (private IP).

Cisco Employee

ACL: Use of private inside IPs in the Internet facing ACL

Here is the release notes for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.html#wp460665

(check out: Firewall Features section: Use of Real IP addresses in access lists instead of translated addresses)

New Member

ACL: Use of private inside IPs in the Internet facing ACL

A pretty good move.  Im not so sure about the object based NAT setup but Im sure I'll get used to it.

Thanks for the tip.

381
Views
0
Helpful
3
Replies
CreatePlease to create content