Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to learn how to use a cisco ASA firewall, and I don't really know what I'm doing. I'm trying to set up some egress filtering, with the goal of allowing only the minimal amount of traffic out of the network, even if it originated from within the inside interface. In other words, I'm trying to set up dmz_in and inside_in ACLs as if the inside interface is not too trustworthy.

I haven't fully grasped all the concepts yet, so I have a few issues.

Assume that we're working with three interfaces: inside, outside, and DMZ.

Let's say I have a server (X.Y.Z.1) that has to respond to PING, HTTP, SSH, FTP, MySQL, and SMTP. My ACL looks something like this:

access-list outside_in extended permit icmp any host X.Y.Z.1 echo-reply
access-list outside_in extended permit tcp any host X.Y.Z.1 eq www
access-list outside_in extended permit tcp any host X.Y.Z.1 eq ssh
access-list outside_in extended permit tcp any host X.Y.Z.1 eq ftp
access-list outside_in extended permit tcp any host X.Y.Z.1 eq ftp-data established
access-list outside_in extended permit tcp any host X.Y.Z.1 eq 3306
access-list outside_in extended permit tcp any host X.Y.Z.1 eq smtp

and I apply it like this:

access-group outside_in in interface outside

My question is, what can I do for egress filtering? I want to only allow the minimal amount of traffic out. Do I just "reverse" the rules (i.e. the smtp rule becomes

access-list inside_out extended permit tcp host X.Y.Z.1 any eq smtp

) and call it a day, or can I further cull my options? What can I safely block?

Furthermore, when doing egress filtering, is it enough to apply "inverted" rules to the outside interface, or should I also look into making dmz_in and inside_in acls?

I've heard the term "egress filtering" thrown around a lot, but I don't really know what I'm doing. Any pointers towards good resources and reading would also be helpful, most of the ones I've found presume that I know a lot more than I do.

share|improve this question
up vote 1 down vote accepted

A little overview, before getting to the specifics. Each interface has two ACLs; an ingress ACL (named interface_in) and an egress ACL (named interface_out). The trick with the naming is to avoid thinking about it in terms of "inside" and "outside"; instead, think of it in terms of "traffic coming (into/out of) this interface".

This gives a lot of flexibility in terms of where you apply a given rule, but can also potentially be a huge source of unneeded complexity.

So, to your example. If you're looking to block connections on port 25 (smtp) that originate from an internal host and are destined for an internet host, you have two options:

access-list inside_in extended deny tcp host X.Y.Z.1 any eq smtp


access-list outside_out extended deny tcp host X.Y.Z.1 any eq smtp

If you only have the two interfaces, these commands will have an identical effect. When this gets complex is when you have more interfaces; say, for instance, a DMZ interface.

The first command (on the inside_in ACL) will only prevent that traffic when it's going inside->outside, but not dmz->outside. The second command (on the outside_out ACL) would prevent both.

So, those are the options for where to apply egress rules. My suggestion for your own sanity is to only utilize one of the two options (and duplicate some rules if you have to); you'll be shooting yourself in the foot if you force yourself to check 5 different ACLs to troubleshoot one traffic flow.

share|improve this answer
Cool, thanks. Did you mean to say "deny" instead of "permit" in those examples? Because otherwise I'm pretty confused. – Nate Mar 7 '11 at 16:44
@Nate Yup - the perils of copy-paste. Fixed, thanks! – Shane Madden Mar 7 '11 at 17:33
Thanks. How bad an idea is it to do my egress filtering by simply "turning around" all my rules and doing a deny-all at the end? For example, can I take the above, switch "outside_in" to "inside_out", change "any host IP" to "host IP any", and switch the "established" from ftp-data to ftp, and be secure? Or would that break a lot of services which need to use other outbound ports? – Nate Mar 7 '11 at 17:37
@Nate outside_in and inside_out are both ingress from the perspective of the overall network. Your internal clients' egress traffic needs to be controlled via either outside_out or inside_in - I'd recommend inside_in. For what rules you need, it'll be different than the rules for your ingress traffic - all of those inbound connections are going to be covered via established connections. Things that you'll need to think about for egress are, for instance, DNS traffic (tcp/udp 53, you can lock it to just a few servers), web browsing to any host (tcp 80/443), NTP (udp 123).. services like that. – Shane Madden Mar 7 '11 at 17:45
So "ingress" means that it crosses either in or out of the network, while "egress" means that it remains in the network? Does that mean that a rule "any HOST eq 80" on outside_in implies the rule "HOST any eq 80" in the outbound direction? So I don't need to say that explicitly? – Nate Mar 7 '11 at 18:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.