Maybe this is a semantics thing, but isn't implicit rule of 'allow to any less secure interface' replaced by an implicit deny once you apply an inbound access-list to an interface? To some people that might be considered negating the security level of the interface (since the security level doesn't really do anything anymore). Once you have inbound ACLs everywhere you may as well not even have security levels.Hopefully today will be the day I learn there's a knob to turn that implicit deny into an implicit allow-to-less-secure which will make me regret all those hours spent tuning DMZ inbound access-lists.
On Wed, Feb 11, 2015 at 8:57 AM, David White, Jr. (dwhitejr) <[email protected]> wrote: > On 2/11/2015 7:29 AM, Joshua Riesenweber wrote: >> This has a few good >> examples:http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/acl_extended.html >> I might very well be wrong, but I believe the security levels are negated if >> an access list is applied to an interface. > That is incorrect. Security levels are not negated or affected by > applying an ACL (or not) to an interface. > > Sincerely, > > David. > >> >> Cheers,Josh >>> Date: Wed, 11 Feb 2015 20:43:37 +1100 >>> From: [email protected] >>> To: [email protected] >>> CC: [email protected] >>> Subject: Re: [c-nsp] ASA >>> >>> Hi madunix, >>> >>> On Wed, Feb 11, 2015 at 7:26 PM, [email protected] <[email protected]> >>> wrote: >>>> I would like to block the following ports: 135,137,138,139,445,593,4444 >>>> tcp/udp on my Firewall >>> [...] >>> >>> Well, what you need to do, is figure out how to block those ports, perhaps >>> by modifying the 'in' access-list you've applied to your outside interface. >>> You might even need to Google That. >>> >>> That's assuming it's that direction (outside > inside) that you want to >>> block the traffic. >>> >>> Cheers, >>> Dale >>> _______________________________________________ >>> cisco-nsp mailing list [email protected] >>> https://puck.nether.net/mailman/listinfo/cisco-nsp >>> archive at http://puck.nether.net/pipermail/cisco-nsp/ >> >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
