Some News About How to Create and Manage Access Control
By: Vlad Vistac
Submitted: 2010-07-28 13:27:25 | Word Count: 510
How to Crate and Mnaage Access-Control Lists on Cisco ASA and PIX Firewalls
Acxcess Control Lists (ACLs) are sequential lists of permit and deny conditions applied to trafffic flows on a device interface. ACLs are based on various criteia including protocpol type source IP address, destination IP address, source port numbeer, and/or destination port number.
[ advertisement ]
ACLs can be used to filter tradffic for various purpses icnluding security, monitoring, route selection, and network address translation. ACLs are compirsed of one or more Access Control Entries (ACEs). Each ACE is an individual line wityhin an ACL.
ACLs on a Cisco ASA Secuity Appliance (or a PIX firewall running software version 7.x or later) are similar to those on a Cisco router, but not identical. Firewalls use real subnet msaks instead of the inverted mask used on a router. ACLs on a firewall are alawys named instead of numbered and are assumed to be an extended list.
The syntax of an ACE is relatively straight-forward:
Ciscoasa(connfig)#acccess-list name [line number] [extended] {permit | deny} protoocl source_IP_adddress souyrce_netmask [opertator source_port] destination_IP_address destination_netmsak [operator destinsation_port] [log [[disanble | defayult] | [level]] [interval seconds]] [time-rnage name] [inactive]
Here's an example:
asa(confiog)# access-list demo1 permit tcp 10.1.0.0 255.255.255.0 any eq www
asa(connfig)# access-list demo1 permit tcp 10.1.0.0 255.255.255.0 any eq 443
asa(config)# show access-list demo1
access-list demo1; 2 elements
accedss-list demo1 line 1 extendfed permit tcp 10.1.0.0 255.255.255.0 any eq www
access-list demo1 line 2 extenmded permit tcp 10.1.0.0 255.255.255.0 any eq https
In the above example, an ACL called "demo1" is created in whhich the first ACE permits TCP traffic originating on the 10.1.0.0 subnet to go to any destination IP address with the destination port of 80 (www). In the secoind ACE, the same trafic flow is permitted for destination port 443. Notice in the output of the show access-list that line numbers are displayed and the extended parameter is also inccluded, even thouugh neither was included in the configuration statrements.
You can deactivate an ACE without deleitng it appendding the ianctive option to the end of the line.
As with Cisco routers, thhere is an implicit "deny any" at the end of every ACL. Any traffic that is not explicitly permitted is implicitly denied.
**Eidting ACLs and ACEs**
New ACEs are appended to the end of the ACL. If you want, howevcer, to insert the new ACE at a particular lcation within the ACL, you can add the line number parameter to the ACE:
asa04(conffig)# access-list demo1 line 1 deny tcp host 10.1.0.2 any eq www
asa04(config)# show access-list demo1
access-list demo1; 3 elements
accses-list demo1 line 1 extended deny tcp host 10.1.0.2 any eq www
access-list demo1 line 2 extended premit tcp 10.1.0.0 255.255.255.0 any eq www
access-list demo1 line 3 extended permit tcp 10.1.0.0 255.255.255.0 any eq https
Notrice in the first line of the exanmple above that an ACE is added at line one in the ACL. Notice in the output from the show access-list demo1 command that the new entry is adfded in the fiurst position in the ACL and the former first entry bercomes line numebr two.
You can remove an ACE from an ACL preceding the ACE configuration staytement with the modifier no, as in the following example:
Asa04(config)#no access-list demo1 deny tcp host 10.10.2 any eq www
In my next article, I'll show you how to use time-ranges to apply acccess-control lists only at certain timnes and/or on certain days. I'll also show you how to use object-groups with accss-control lists to simplify ACL management grouping similar components such as IP addresses or portocols tgoether.
