Access Control Lists

-------------------p.s >> can not ping indirectly connected interfaces (How ASA designed),
>> set up NAT and allow ICMP Traffics

-> Terdiri dari ACEs (Permit/Deny)

-> Order matters!!! Always go from most specific to most general
-> Implicit deny any
-----------------------------------------------------------------------------------asa<config># access-list demo1 permit tcp 10.1.0.0 255.255.255.0 any eq www
asa<config># show access-list
------------------------------------------------------------------------------------> Entries based on line, determine the line to add (no access-list . . .to remo
ved)
================================================================================
=====
Time range
---------e.g.
<config># time-range workweek
<config-time-range># periodic weekdays 08:00 to 17:00
<config-time-range># access-list www_restrict deny tcp any any eq www time-range
workweek
-----------------------------------------------------------------------------------Object Groups
-------------> Consists of multiple object
-> Type includes : Network, Protocol, Service, ICMP Object Group
e.g.
asa<config># access-list demo2 permit tcp object-group Accounting any eq www
asa<config># access-list demo2 permit tcp object-group Accounting any eq 443
Using ACL (ICMP)
---------------->
->
->
->

access-list
access-list
access-list
access-list

100
100
100
100

permit
permit
permit
permit

icmp
icmp
icmp
icmp

any
any
any
any

any
any
any
any

echo-reply
source-quench
unreachable
time-exceeded