Cisco ASA 5508-X, Configuration Manual

Page: 57 / 428

4-11
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 4 Access Rules
Configuration Examples for Permitting or Denying Network Access
Permitted packets that belong to established connections do not need to be checked against ACLs; only
the initial packet is logged and included in the hit count. For connectionless protocols, such as ICMP, all
packets are logged, even if they are permitted, and all denied packets are logged.
See the syslog messages guide for detailed information about these messages.
Tip
When you enable logging for message 106100, if a packet matches an ACE, the ASA creates a flow entry
to track the number of packets received within a specific interval. The ASA has a maximum of 32 K
logging flows for ACEs. A large number of flows can exist concurrently at any point of time. To prevent
unlimited consumption of memory and CPU resources, the ASA places a limit on the number of
concurrent
deny flows; the limit is placed on deny flows only (not on permit flows) because they can
indicate an attack. When the limit is reached, the ASA does not create a new deny flow for logging until
the existing flows expire, and issues message 106101. You can control the frequency of this message
using the
access-list alert-interval secs command, and the maximum number of deny flows cached
using the access-list deny-flow-max number command.
Configuration Examples for Permitting or Denying Network
Access
This section includes typical configuration examples for permitting or denying network access.
The following example adds a network object for inside server 1, performs static NAT for the server, and
enables access from the outside for inside server 1.
hostname(config)# object network inside-server1
hostname(config)# host 10.1.1.1
hostname(config)#
nat (inside,outside) static 209.165.201.12
hostname(config)# access-list outside_access extended permit tcp any object inside-server1
eq www
hostname(config)#
access-group outside_access in interface outside
The following example allows all hosts to communicate between the inside and hr networks but only
specific hosts to access the outside network:
hostname(config)# access-list ANY extended permit ip any any
hostname(config)# access-list OUT extended permit ip host 209.168.200.3 any
hostname(config)# access-list OUT extended permit ip host 209.168.200.4 any
hostname(config)# access-group ANY in interface inside
hostname(config)# access-group ANY in interface hr
hostname(config)# access-group OUT out interface outside
For example, the following sample ACL allows common EtherTypes originating on the inside interface:
hostname(config)#
access-list ETHER ethertype permit ipx
hostname(config)# access-list ETHER ethertype permit mpls-unicast
hostname(config)# access-group ETHER in interface inside
The following example allows some EtherTypes through the ASA, but it denies all others:
hostname(config)# access-list ETHER ethertype permit 0x1234
hostname(config)# access-list ETHER ethertype permit mpls-unicast
hostname(config)# access-group ETHER in interface inside
hostname(config)# access-group ETHER in interface outside