Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Allow/Block any type of services from Cisco ASA 5510 Extended Access List

Hi,

     I have created Different extended access-list which allow/block some specific services like IP,TCP,UDP ,ICMP etc for certain source and destination . But now I have to allow/Block all/any type of services to a certain host from a extended access-list . How can I do it ?

2 ACCEPTED SOLUTIONS

Accepted Solutions

Allow/Block any type of services from Cisco ASA 5510 Extended Ac

Hi Madhav,

access-list inbound extended deny ip any host . This statement blocks any traffic towards to that particular host.

protocol IP includes tcp/udp/icmp.... so this will block everything.

But make sure that this rule should be on the top. So that deny traffic towards that host will work. If you place this rule in middle or last then if you have any permit rule for the entire segment or set that allows the access.

Please do rate if the given information helps.

By

Karthik

Allow/Block any type of services from Cisco ASA 5510 Extended Ac

Hi Madhav,

See the below table which will show the list of protocols which is considered as IP protocol. We have around 150 protocol id's under IP. So when you say IP deny any any this will block all the protocols whatever you have listed above.

Decimal Hex Keyword Protocol References
00x00HOPOPTIPv6 Hop-by-Hop OptionRFC 2460
10x01ICMPInternet Control Message ProtocolRFC 792
20x02IGMPInternet Group Management ProtocolRFC 1112
30x03GGPGateway-to-Gateway ProtocolRFC 823
40x04IPv4IPv4 (encapsulation)RFC 791
50x05STInternet Stream ProtocolRFC 1190, RFC 1819
60x06TCPTransmission Control ProtocolRFC 793
70x07CBTCore-based treesRFC 2189
80x08EGPExterior Gateway ProtocolRFC 888
90x09IGPInterior Gateway Protocol (any private interior gateway (used by Cisco for their IGRP))
100x0ABBN-RCC-MONBBN RCC Monitoring
110x0BNVP-IINetwork Voice ProtocolRFC 741
120x0CPUPXerox PUP
130x0DARGUSARGUS
140x0EEMCONEMCON
150x0FXNETCross Net DebuggerIEN 158
160x10CHAOSChaos
170x11UDPUser Datagram ProtocolRFC 768
180x12MUXMultiplexingIEN 90
190x13DCN-MEASDCN Measurement Subsystems
200x14HMPHost Monitoring ProtocolRFC 869
210x15PRMPacket Radio Measurement
220x16XNS-IDPXEROX NS IDP
230x17TRUNK-1Trunk-1
240x18TRUNK-2Trunk-2
250x19LEAF-1Leaf-1
260x1ALEAF-2Leaf-2
270x1BRDPReliable Datagram ProtocolRFC 908
280x1CIRTPInternet Reliable Transaction ProtocolRFC 938
290x1DISO-TP4ISO Transport Protocol Class 4RFC 905
300x1ENETBLTBulk Data Transfer ProtocolRFC 998
310x1FMFE-NSPMFE Network Services Protocol
320x20MERIT-INPMERIT Internodal Protocol
330x21DCCPDatagram Congestion Control ProtocolRFC 4340
340x223PCThird Party Connect Protocol
350x23IDPRInter-Domain Policy Routing ProtocolRFC 1479
360x24XTPXpress Transport Protocol
370x25DDPDatagram Delivery Protocol
380x26IDPR-CMTPIDPR Control Message Transport Protocol
390x27TP++TP++ Transport Protocol
400x28ILIL Transport Protocol
410x29IPv6IPv6 (encapsulation)RFC 2473, RFC 3056
420x2ASDRPSource Demand Routing ProtocolRFC 1940
430x2BIPv6-RouteRouting Header for IPv6RFC 2460
440x2CIPv6-FragFragment Header for IPv6RFC 2460
450x2DIDRPInter-Domain Routing Protocol
460x2ERSVPResource Reservation ProtocolRFC 2205
470x2FGREGeneric Routing EncapsulationRFC 2784, RFC 2890
480x30MHRPMobile Host Routing Protocol
490x31BNABNA
500x32ESPEncapsulating Security PayloadRFC 4303
510x33AHAuthentication HeaderRFC 4302
520x34I-NLSPIntegrated Net Layer Security ProtocolTUBA
530x35SWIPESwIPeIP with Encryption
540x36NARPNBMA Address Resolution ProtocolRFC 1735
550x37MOBILEIP Mobility (Min Encap)RFC 2004
560x38TLSPTransport Layer Security Protocol (using Kryptonet key management)
570x39SKIPSimple Key-Management for Internet ProtocolRFC 2356
580x3AIPv6-ICMPICMP for IPv6RFC 4443, RFC 4884
590x3BIPv6-NoNxtNo Next Header for IPv6RFC 2460
600x3CIPv6-OptsDestination Options for IPv6RFC 2460
610x3D
Any host internal protocol
620x3ECFTPCFTP
630x3F
Any local network
640x40SAT-EXPAKSATNET and Backroom EXPAK
650x41KRYPTOLANKryptolan
660x42RVDMIT Remote Virtual Disk Protocol
670x43IPPCInternet Pluribus Packet Core
680x44
Any distributed file system
690x45SAT-MONSATNET Monitoring
700x46VISAVISA Protocol
710x47IPCVInternet Packet Core Utility
720x48CPNXComputer Protocol Network Executive
730x49CPHBComputer Protocol Heart Beat
740x4AWSNWang Span Network
750x4BPVPPacket Video Protocol
760x4CBR-SAT-MONBackroom SATNET Monitoring
770x4DSUN-NDSUN ND PROTOCOL-Temporary
780x4EWB-MONWIDEBAND Monitoring
790x4FWB-EXPAKWIDEBAND EXPAK
800x50ISO-IPInternational Organization for Standardization Internet Protocol
810x51VMTPVersatile Message Transaction ProtocolRFC 1045
820x52SECURE-VMTPSecure Versatile Message Transaction ProtocolRFC 1045
830x53VINESVINES
840x54TTPTTP
840x54IPTMInternet Protocol Traffic Manager
850x55NSFNET-IGPNSFNET-IGP
860x56DGPDissimilar Gateway Protocol
870x57TCFTCF
880x58EIGRPEIGRP
890x59OSPFOpen Shortest Path FirstRFC 1583
900x5ASprite-RPCSprite RPC Protocol
910x5BLARPLocus Address Resolution Protocol
920x5CMTPMulticast Transport Protocol
930x5DAX.25AX.25
940x5EIPIPIP-within-IP Encapsulation Protocol
950x5FMICPMobile Internetworking Control Protocol
960x60SCC-SPSemaphore Communications Sec. Pro
970x61ETHERIPEthernet-within-IP EncapsulationRFC 3378
980x62ENCAPEncapsulation HeaderRFC 1241
990x63
Any private encryption scheme
1000x64GMTPGMTP
1010x65IFMPIpsilon Flow Management Protocol
1020x66PNNIPNNI over IP
1030x67PIMProtocol Independent Multicast
1040x68ARISIBM's ARIS (Aggregate Route IP Switching) Protocol
1050x69SCPSSCPS (Space Communications Protocol Standards)SCPS-TP[1]
1060x6AQNXQNX
1070x6BA/NActive Networks
1080x6CIPCompIP Payload Compression ProtocolRFC 3173
1090x6DSNPSitara Networks Protocol
1100x6ECompaq-PeerCompaq Peer Protocol
1110x6FIPX-in-IPIPX in IP
1120x70VRRPVirtual Router Redundancy Protocol, Common Address Redundancy Protocol (not IANA assigned)VRRP:RFC 3768
1130x71PGMPGM Reliable Transport ProtocolRFC 3208
1140x72
Any 0-hop protocol
1150x73L2TPLayer Two Tunneling Protocol Version 3RFC 3931
1160x74DDXD-II Data Exchange (DDX)
1170x75IATPInteractive Agent Transfer Protocol
1180x76STPSchedule Transfer Protocol
1190x77SRPSpectraLink Radio Protocol
1200x78UTIUTI
1210x79SMPSimple Message Protocol
1220x7ASMSM
1230x7BPTPPerformance Transparency Protocol
1240x7C
IS-IS over IPv4
1250x7DFIRE

1260x7ECRTPCombat Radio Transport Protocol
1270x7FCRUDPCombat Radio User Datagram
1280x80SSCOPMCE

1290x81IPLT

1300x82SPSSecure Packet Shield
1310x83PIPEPrivate IP Encapsulation within IPExpired I-D draft-petri-mobileip-pipe-00.txt
1320x84SCTPStream Control Transmission Protocol
1330x85FCFibre Channel
1340x86
RSVP-E2E-IGNORERFC 3175
1350x87
Mobility HeaderRFC 3775
1360x88
UDP LiteRFC 3828
1370x89
MPLS-in-IPRFC 4023
1380x8AmanetMANET ProtocolsRFC 5498
1390x8BHIPHost Identity ProtocolRFC 5201
1400x8CShim6Site Multihoming by IPv6 IntermediationRFC 5533
141-2520x8D-0xFCUNASSIGNED
253-2540xFD-0xFEUse for experimentation and testingRFC 3692
2550xFFReserved.

Please do rate if the given information helps.

By

Karthik

4 REPLIES

Allow/Block any type of services from Cisco ASA 5510 Extended Ac

Hi Madhav,

access-list inbound extended deny ip any host . This statement blocks any traffic towards to that particular host.

protocol IP includes tcp/udp/icmp.... so this will block everything.

But make sure that this rule should be on the top. So that deny traffic towards that host will work. If you place this rule in middle or last then if you have any permit rule for the entire segment or set that allows the access.

Please do rate if the given information helps.

By

Karthik

New Member

Allow/Block any type of services from Cisco ASA 5510 Extended Ac

Thanks Karthik,

This information seems very helpful to me. I was confused that the Protocol IP is among one of the several list including

ah,  eigrp,  esp,  gre,  icmp,  icmp6,  igmp,  igrp, ip,  ipinip,  ipsec ............ So specifying IP only in the access-list can allow/block all type of traffic or not.

Regards,

Madhav

Allow/Block any type of services from Cisco ASA 5510 Extended Ac

Hi Madhav,

See the below table which will show the list of protocols which is considered as IP protocol. We have around 150 protocol id's under IP. So when you say IP deny any any this will block all the protocols whatever you have listed above.

Decimal Hex Keyword Protocol References
00x00HOPOPTIPv6 Hop-by-Hop OptionRFC 2460
10x01ICMPInternet Control Message ProtocolRFC 792
20x02IGMPInternet Group Management ProtocolRFC 1112
30x03GGPGateway-to-Gateway ProtocolRFC 823
40x04IPv4IPv4 (encapsulation)RFC 791
50x05STInternet Stream ProtocolRFC 1190, RFC 1819
60x06TCPTransmission Control ProtocolRFC 793
70x07CBTCore-based treesRFC 2189
80x08EGPExterior Gateway ProtocolRFC 888
90x09IGPInterior Gateway Protocol (any private interior gateway (used by Cisco for their IGRP))
100x0ABBN-RCC-MONBBN RCC Monitoring
110x0BNVP-IINetwork Voice ProtocolRFC 741
120x0CPUPXerox PUP
130x0DARGUSARGUS
140x0EEMCONEMCON
150x0FXNETCross Net DebuggerIEN 158
160x10CHAOSChaos
170x11UDPUser Datagram ProtocolRFC 768
180x12MUXMultiplexingIEN 90
190x13DCN-MEASDCN Measurement Subsystems
200x14HMPHost Monitoring ProtocolRFC 869
210x15PRMPacket Radio Measurement
220x16XNS-IDPXEROX NS IDP
230x17TRUNK-1Trunk-1
240x18TRUNK-2Trunk-2
250x19LEAF-1Leaf-1
260x1ALEAF-2Leaf-2
270x1BRDPReliable Datagram ProtocolRFC 908
280x1CIRTPInternet Reliable Transaction ProtocolRFC 938
290x1DISO-TP4ISO Transport Protocol Class 4RFC 905
300x1ENETBLTBulk Data Transfer ProtocolRFC 998
310x1FMFE-NSPMFE Network Services Protocol
320x20MERIT-INPMERIT Internodal Protocol
330x21DCCPDatagram Congestion Control ProtocolRFC 4340
340x223PCThird Party Connect Protocol
350x23IDPRInter-Domain Policy Routing ProtocolRFC 1479
360x24XTPXpress Transport Protocol
370x25DDPDatagram Delivery Protocol
380x26IDPR-CMTPIDPR Control Message Transport Protocol
390x27TP++TP++ Transport Protocol
400x28ILIL Transport Protocol
410x29IPv6IPv6 (encapsulation)RFC 2473, RFC 3056
420x2ASDRPSource Demand Routing ProtocolRFC 1940
430x2BIPv6-RouteRouting Header for IPv6RFC 2460
440x2CIPv6-FragFragment Header for IPv6RFC 2460
450x2DIDRPInter-Domain Routing Protocol
460x2ERSVPResource Reservation ProtocolRFC 2205
470x2FGREGeneric Routing EncapsulationRFC 2784, RFC 2890
480x30MHRPMobile Host Routing Protocol
490x31BNABNA
500x32ESPEncapsulating Security PayloadRFC 4303
510x33AHAuthentication HeaderRFC 4302
520x34I-NLSPIntegrated Net Layer Security ProtocolTUBA
530x35SWIPESwIPeIP with Encryption
540x36NARPNBMA Address Resolution ProtocolRFC 1735
550x37MOBILEIP Mobility (Min Encap)RFC 2004
560x38TLSPTransport Layer Security Protocol (using Kryptonet key management)
570x39SKIPSimple Key-Management for Internet ProtocolRFC 2356
580x3AIPv6-ICMPICMP for IPv6RFC 4443, RFC 4884
590x3BIPv6-NoNxtNo Next Header for IPv6RFC 2460
600x3CIPv6-OptsDestination Options for IPv6RFC 2460
610x3D
Any host internal protocol
620x3ECFTPCFTP
630x3F
Any local network
640x40SAT-EXPAKSATNET and Backroom EXPAK
650x41KRYPTOLANKryptolan
660x42RVDMIT Remote Virtual Disk Protocol
670x43IPPCInternet Pluribus Packet Core
680x44
Any distributed file system
690x45SAT-MONSATNET Monitoring
700x46VISAVISA Protocol
710x47IPCVInternet Packet Core Utility
720x48CPNXComputer Protocol Network Executive
730x49CPHBComputer Protocol Heart Beat
740x4AWSNWang Span Network
750x4BPVPPacket Video Protocol
760x4CBR-SAT-MONBackroom SATNET Monitoring
770x4DSUN-NDSUN ND PROTOCOL-Temporary
780x4EWB-MONWIDEBAND Monitoring
790x4FWB-EXPAKWIDEBAND EXPAK
800x50ISO-IPInternational Organization for Standardization Internet Protocol
810x51VMTPVersatile Message Transaction ProtocolRFC 1045
820x52SECURE-VMTPSecure Versatile Message Transaction ProtocolRFC 1045
830x53VINESVINES
840x54TTPTTP
840x54IPTMInternet Protocol Traffic Manager
850x55NSFNET-IGPNSFNET-IGP
860x56DGPDissimilar Gateway Protocol
870x57TCFTCF
880x58EIGRPEIGRP
890x59OSPFOpen Shortest Path FirstRFC 1583
900x5ASprite-RPCSprite RPC Protocol
910x5BLARPLocus Address Resolution Protocol
920x5CMTPMulticast Transport Protocol
930x5DAX.25AX.25
940x5EIPIPIP-within-IP Encapsulation Protocol
950x5FMICPMobile Internetworking Control Protocol
960x60SCC-SPSemaphore Communications Sec. Pro
970x61ETHERIPEthernet-within-IP EncapsulationRFC 3378
980x62ENCAPEncapsulation HeaderRFC 1241
990x63
Any private encryption scheme
1000x64GMTPGMTP
1010x65IFMPIpsilon Flow Management Protocol
1020x66PNNIPNNI over IP
1030x67PIMProtocol Independent Multicast
1040x68ARISIBM's ARIS (Aggregate Route IP Switching) Protocol
1050x69SCPSSCPS (Space Communications Protocol Standards)SCPS-TP[1]
1060x6AQNXQNX
1070x6BA/NActive Networks
1080x6CIPCompIP Payload Compression ProtocolRFC 3173
1090x6DSNPSitara Networks Protocol
1100x6ECompaq-PeerCompaq Peer Protocol
1110x6FIPX-in-IPIPX in IP
1120x70VRRPVirtual Router Redundancy Protocol, Common Address Redundancy Protocol (not IANA assigned)VRRP:RFC 3768
1130x71PGMPGM Reliable Transport ProtocolRFC 3208
1140x72
Any 0-hop protocol
1150x73L2TPLayer Two Tunneling Protocol Version 3RFC 3931
1160x74DDXD-II Data Exchange (DDX)
1170x75IATPInteractive Agent Transfer Protocol
1180x76STPSchedule Transfer Protocol
1190x77SRPSpectraLink Radio Protocol
1200x78UTIUTI
1210x79SMPSimple Message Protocol
1220x7ASMSM
1230x7BPTPPerformance Transparency Protocol
1240x7C
IS-IS over IPv4
1250x7DFIRE

1260x7ECRTPCombat Radio Transport Protocol
1270x7FCRUDPCombat Radio User Datagram
1280x80SSCOPMCE

1290x81IPLT

1300x82SPSSecure Packet Shield
1310x83PIPEPrivate IP Encapsulation within IPExpired I-D draft-petri-mobileip-pipe-00.txt
1320x84SCTPStream Control Transmission Protocol
1330x85FCFibre Channel
1340x86
RSVP-E2E-IGNORERFC 3175
1350x87
Mobility HeaderRFC 3775
1360x88
UDP LiteRFC 3828
1370x89
MPLS-in-IPRFC 4023
1380x8AmanetMANET ProtocolsRFC 5498
1390x8BHIPHost Identity ProtocolRFC 5201
1400x8CShim6Site Multihoming by IPv6 IntermediationRFC 5533
141-2520x8D-0xFCUNASSIGNED
253-2540xFD-0xFEUse for experimentation and testingRFC 3692
2550xFFReserved.

Please do rate if the given information helps.

By

Karthik

New Member

Allow/Block any type of services from Cisco ASA 5510 Extended Ac

Thanks Karthik,

                      Now I am clear about the "ANY" services in Fortigate policy compared with IP in access-list in Cisco ASA 5510. Thank you very much.

Regards,

Madhav

5798
Views
0
Helpful
4
Replies
CreatePlease login to create content