permit any to 1.2.3.4

[LionKin1984]

Hi All

is it possible to create a ACL to permit from any to a particular ip address? i.e I have a ASA with three interfaces (inside, outside and DMZ) and I want to create a ACL to permit from any to inside host (this is probably a bad example but anyway..),

the ACL should look like:

ASA (config) # access-list any-inside extended permit ip any object Inside-host

however what interface should I apply the ACL on?

ASA (config) # access-group any-inside in interface ???                   

thanks

[Marvin Rhoads]

If the outside is Internet, you'd generally also have a 1-1 NAT rule for the host in question. Depending on your ASA software version, the access-list would refer to either the NAT address (ASA <8.3) or the real host address (ASA >= 8.3).

The access-list is applied to the outside interface. You want to evalaute and allow or deny the connection at the first interface it hits on the ASA.

[LionKin1984]

Thanks for your reply Marvin, I will apply ACL to outside interface see what happens then

Cheers