We manage a lot of ASA firewalls which have fairly similar setups. Most firewalls have at least an inside, dmz and outside interface. For the inside interface ACL, we leave the default ACL in place with the implicit permit to less secure networks and implicit deny. For the dmz and any other internal interfaces, we want to permit access to the outside but not necessarily between the other interfaces. The implicit ACLs would normally work for them but we run into issues when we need to permit traffic between those interfaces. When we add a permit entry we lose the implicit permit to less secure networks and hosts on that interface will lose access to the outside network. As a result, we ended up setting up the ACLs like this:
access-list dmz_access_in extended permit tcp <dmz_host> <inside_host> eq 1433
access-list dmz_access_in extended deny ip <dmz_network> <inside_network>
access-list dmz_access_in extended permit ip <dmz_network> any
But if we have additional interfaces, we also need to explicitly deny traffic to them. So the ACL would look like this:
access-list dmz_access_in extended permit tcp <dmz_host> <inside_host> eq 1433
access-list dmz_access_in extended deny ip <dmz_network> <inside_network>
access-list dmz_access_in extended deny ip <dmz_network> <dmz2_network>
access-list dmz_access_in extended deny ip <dmz_network> <dmz3_network>
....
access-list dmz_access_in extended permit ip <dmz_network> any
I don't like have to explictly add a permit any any in order to grant access to the outside network. Obviously, this would be bad if we forgot to explicitly add a deny entry for another interface. I took a look at the global access list in 8.3+ but it also removed the implicit permit on the interface ACL as soon as I added an entry to the global. Is there anyway to recreate the implicit permit to less secure networks?
