I am after a general consensus on permit ip any any, is this command ever acceptable ?
A PCI audit has just taken place on our network and a permit ip any any was found, since then all hell has broken lose. Please see below explanation for the design.
Our Network is based on a multi tier approach, which is based on the following.
LAN – Access Lists applied to the layer three SVI’s. the purpose of this ACL is to control LAN based traffic for example access to DC’s, ISA, Exchange etc. at the end of this ACL under the deny to anything LAN, is an IP any any, this permits access destined to anything not internal in LAN, this is then filtered at the Inner ASA.
Inner ASA – Most restrictive Access lists are placed at this layer on the inside, outside thrid party and DMZ interfaces. This controls access from LAN to External based connections such as the Internet and MPLS connections. We also control what traffic can come in from the outside in terms of VPN’s. This layer is treated as our strongest layer of traffic control.
Outer ASA – Due to the restrictive filtering on the Inner ASA, we trust the traffic that is sourced from the inside network as it has already been filtered by the Inner layer. The main purpose of the Outer layer is to be a termination point for VPN’s and control traffic that is connecting from the Internet towards the servers that are in the DMZ. To secure further we also NAT to a completely separate private range on the Outer Layer for anything that is accessible from the Internet.
Each layer of Firewalls have a distinct purpose as by design and I feel they are performing in an efficient way to provide a high level of data throughput.
The ip any any is actually by design and has been placed on the Outer ASA's inside interface, the thought process behind this is mainly for supportability in terms of making changes etc, as i do not see the benefit of replicating the rule base from my Inner to my Outer, as this in theory would be the same as an ip any any as it is only possible for my inside network to traverse this interface.
(Mind you) I'm not familiar with the exact design so I assume it's linear.
users --- LAN ACLs ---- Inner ASA ----outer ASA --- WAN
As a disclaimer I want to say that I'm just saying what makes sense to me and it's in no way a statment by Cisco
Applying inbound filtering on inside of outer ASA makes little sense, traffic is incoing from more trusted devices going towards the less trusted WAN.
That's why indeed Cisco assume that traffic is to be allowed. Since ASA is stetful we know that only return traffic will be allowed (or whatever we allow on the outside access-list).
I understand that there is no untrusted device between the two ASAs
I've seen a similar problem from auditors before, for the most part they do understand that firewalls now are stateful, and protection does not come from ACLs.
That being said there's rarely a point in arguing with audit, for you own piece of mind comply with them. Apply an access-list there and deny traffic to auditor's company HQ , even if you permit any any at the end you can always justify that it's there to block know abusive hosts.
Thanks very much for your reply, what is your opion on the never use a permit ip any any on a firewall, in my opion if the infrastructure is secure then a permit ip any any is acceptible, but I am not sure if this goes against best practice.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...