Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Cisco 5520 Rule configurations...

I am new the the ASA5520 coming from a checkpoint world. I am setting up my acl's (i am used to them being called rules) and noticed that my options are permit and deny. In the Checkpoint world I was able to also tag the line with drop. This was due to the fact that (atleast with checkpoint) even if you said deny it would send a response packet back to the source. Will this happen with the ASA with only a deny or does this firewall handle the deny packets differently?

Thanks in advance

Pete

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: Cisco 5520 Rule configurations...

The cisco acl which denys is sending the packet to the bit bucket. I can only imagine that the "deny" feature that you are referring to with the CHeckpoint product would amount to a TCP reset and as such would only be applicable when dealing with TCP traffic. This level of fuctionality is delivered at IPS/IDS level on Cisco solutions. CBAC in IOS has an architecture more similar I suppose:

http://www.cisco.com/en/US/products/ps6586/products_qanda_item09186a008009464d.shtml#qa3

but is still not as monolithic as what you have described with the "rule" concept in Checkpoint.

HTH

mike

1 REPLY
Silver

Re: Cisco 5520 Rule configurations...

The cisco acl which denys is sending the packet to the bit bucket. I can only imagine that the "deny" feature that you are referring to with the CHeckpoint product would amount to a TCP reset and as such would only be applicable when dealing with TCP traffic. This level of fuctionality is delivered at IPS/IDS level on Cisco solutions. CBAC in IOS has an architecture more similar I suppose:

http://www.cisco.com/en/US/products/ps6586/products_qanda_item09186a008009464d.shtml#qa3

but is still not as monolithic as what you have described with the "rule" concept in Checkpoint.

HTH

mike

144
Views
0
Helpful
1
Replies
CreatePlease to create content