Applying ACL on outside interface of ASA

[mahesh18]

Hi Everyone,

Say we have ASA  with many interfaces.

Users are on interface x  .

Interface x has ACL  that allows access to certain IP address only and it has deny ip any any at the end.

Now user needs access to some website on specfic port only.

If i make ACL  on outside interface of ASA allowing access to that website on specfic port  direction outwards from source any  it should work right ?

Regards

Mahesh

[Julio Carvajal · Accepted solution]

Hello,

It should,

make sure the Permit statement is before the deny one

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

[Jouni Forss · Accepted solution]

Hi Mahesh,

Generally you allow and/or restrict user traffic in the interface ACL closest to the user. In your case it would be interface X's ACL.

When the user attempts the connection to the site, the first thing that will be checked is the interface X ACL if there is one that is attached to the "in" direction.

So I would imagine that there is no need to configure a new ACL for this purpose. Just use the existing ACL on the interface X to allow what traffic you need since it will be the first one checked and there isnt really need to do it twice.

- Jouni

[mahesh18]

Hi Jouni,

I agreee what you say as extended ACL are applied close to source.

But current design here  allows  outbound interface  as traffic leaves the ASA  to allow certain websites .

Regards

Mahesh