1

So a minor problem we have is any internal servers have no (non-icmp) access to the outside is being blocked. Our current config is:

inside_access_in any ---> any ---> icmp  
inside_access_out any ---> any ---> ip 

I understand that if i add "any - any - ip" to inside_access_in that will probably fix the problem, right? my main question is, why?

what is the difference between inside_access_in and inside_access_out ?

will adding "any --> any --> ip" to "inside_access_in" provide any additional access from the outside world to the internal interfaces - something I don't want to do..

here is sh run access-group;

sh run access-group
access-group inside_access_in in interface inside
access-group inside_access_out out interface inside
access-group outside_access_in in interface outside
1
  • I'm assuming inside_access_in and inside_access_out are the names of access-lists on the ASA? Can you post the output of sh run access-group?
    – Andy Smith
    Jan 18, 2015 at 21:27

1 Answer 1

4

what is the difference between inside_access_in and inside_access_out ?

Inside_access_in and Inside_access_out are just friendly names for your access lists.

In your case, Inside_access_in is an 'Inbound' access-list, and inside_access_out is an 'Outbound' access list. An inbound access-list is applied to traffic as it ENTERS that interface. Inversely, an outbound access-list is applied to traffic as it EXITS that interface. So if you apply an inbound access-list to your inside interface, then it will apply to traffic that enters the inside interface from the inside network. Make sense?

Currently your configuration is preventing any non-icmp traffic from entering the inside interface on the firewall.

I understand that if i add "any - any - ip" to inside_access_in that will probably fix the problem, right? my main question is, why?

Yes, that is correct, as I mentioned before, you're currently ONLY allowing ICMP traffic to enter the inside interface from the inside network, you need to allow other types of traffic.

will adding "any --> any --> ip" to "inside_access_in" provide any additional access from the outside world to the internal interfaces - something I don't want to do..

No, it won't allow any additional traffic from the OUTSIDE. However, it will allow ALL traffic from your inside interface to get to the outside, this may or may not be something you want.

Typically you will set the inbound access list on your inside interface to allow only the types of traffic you actually want to leave the network and access the outside world.

Additionally, I see you're using outbound access lists, and I think this is the source of much of your confusion. You should only use outbound access-lists if you have a use-case that requires it. By default a Cisco ASA will allow all traffic from a higher-security interface (Inside) to a lower-security interface (Outside). Provided that you have set your security levels correctly then this would render your current outbound access-list completely redundant. I suggest you give this Cisco article a good read as it explains your current woes.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa70/configuration/guide/config/nwaccess.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .