ASA Basic Access List

Access-lists are commonly used to implement traffic filtering in the ASA firewalls. By default, ASA permits sessions to be initiated from a higher security level interface to a lower security level interface. When traffic is allowed one way, a session state is created in the state/conn table and return traffic will be automatically allowed back in; thus, access-lists or security-level does not apply to the return traffic:

At a minimum, using access-lists allows you to do the following:

-          Permit access from the lower security level interfaces to higher security level interfaces.

-          Restrict access between interfaces with same security-level if this is allowed (by default, it is not and requires the global command same-security-traffic permit inter-interface).

-          Permit return traffic for sessions that are not inspected by the ASA firewall (such as for ICMP, which is not inspected by default, or for the traceroute command).

-          Permits return traffic for multicast traffic, which cannot be inspected by the firewall because traffic is multicast one-way and unicast for return.

-          Filter routing updates for OSPF and RIP routing processes.

ASA supports both IPv4 and IPv6 access-lists, both standard and extended. Just like on a router, you can apply a maximum of one access-list per protocol, per interface, per direction, so the maximum allowed is:

One IPv4 and one IPv6 ACL applied inbound on an interface; configured with the command access-group <ACL> in interface <nameif> .

One IPv4 and one IPv6 ACL applied outbound on an interface; configured with the command access-group <ACL> out interface <nameif> .

Starting with code 8.3(1), you can also apply one IPv4 and one IPv6 ACL globally, configured with the command access-group <ACL> global; the global access-list is always interpreted as an inbound ACL. When the global ACL is applied, the implicit deny ip any any rule is removed from any ACL applied inbound on any interfaces, so that the global ACL is inspected. Assuming all ACLs are configured, and assuming a packet enters the inside interface and exits the outside interface, the rules are:

-          Traffic is matched against the inbound ACL applied on the inside interface. If there is a match, the action is taken; if not, it will match on the default deny ip any any unless global ACL is configured.

-          Traffic is matched against the global ACL. If there is a match, the action is taken; if not, it will match on the default deny ip any any rule.

-          

     Traffic is matched against the outbound ACL applied on the outside interface. If there is a match, the action is taken; if not, it will match on the default deny ip any any rule.

When an ACL is applied inbound on an interface, all inbound traffic is subject to the ACL rules, and the default security-level rule no longer applies; when an ACL is applied globally, all inbound traffic from all interfaces is subject to the global ACL, and the security-level rules no longer apply.

ASA also supports ethertype and webtype ACLs. Note that MPF engine of the ASA inspects FTP and TFTP by default. But ICMP inspection is not enabled by default. For UNIX style traceroute, you must allow the returning ICMP unreachable and time-exceeded messages.

TASK

Configure Firewall to allow following traffic inbound on its outside interface; use an interface ACL

-          TELNET/SSH/FTP/TFTP/HTTPS from Router2's Loopback0 address.

-          Return traffic for UNIX style traceroute.

Configure Firewall to allow the following traffic inbound on its inside interface; use a global ACL:

-          PING from Router1 to Router2.

-          SYSLOG/HTTP/RDP towards Router2 from Router1