I'm shortly going to be in a situation where I'll need to be updating a firewall on the fly. How does one update cisco ASA access lists on the fly? For example, if I start with:
access-list outside_in extended ip deny any any access-list outside_in extended tcp deny any any access-list outside_in extended udp deny any any access-list outside_in extended icmp deny any any
(A little harsh, I know, but bear with me. Out of curiosity, is there an easier way to deny everything?)
access-group outside_in in interface DMZ
then how do I later update the access-list to open, say, port 80? Short of re-writing the entire access list. I can't just add a rule, because packets will be denied by the previous rules. So, I guess what I'm asking is, how do I add a rule to the beginning of an access list?