CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.2

Information About Access Control Lists

---

Access control lists (ACLs) identify traffic flows by one or more characteristics, including source and destination IP address, IP protocol, ports, EtherType, and other parameters, depending on the type of ACL. ACLs are used in a variety of features. ACLs are made up of one or more access control entries (ACEs). An ACE is a single entry in an ACL that specifies a permit or deny rule.

• ACL Types
• Access Control Entry Order
• Access Control Implicit Deny
• IP Addresses Used for ACLs When You Use NAT
• Where to Go Next

ACL Types

The ASA uses five types of ACLs:

• Standard ACLs—Identify the destination IP addresses of OSPF routes and can be used in a route map for OSPF redistribution. Standard ACLs cannot be applied to interfaces to control traffic. For more information, see Chapter23, “Standard Access Control Lists”
• Extended ACLs—Use one or more access control entries (ACE) in which you can specify the line number to insert the ACE, the source and destination addresses, and, depending upon the ACE type, the protocol, the ports (for TCP or UDP), or the IPCMP type (for ICMP). For more information, see Chapter21, “Extended Access Control Lists”
• EtherType ACLs—Use one or more ACEs that specify an EtherType. For more information, see Chapter22, “EtherType Access Control Lists”
• Webtype ACLs—Used in a configuration that supports filtering for clientless SSL VPN. For more information, see Chapter24, “Webtype Access Control Lists”

Table 20-1 lists the types of ACLs and some common uses for them.

Access Control Entry Order

An ACL is made up of one or more access control entries (ACEs). Each ACE that you enter for a given ACL name is appended to the end of the ACL. Depending on the ACL type, you can specify the source and destination addresses, the protocol, the ports (for TCP or UDP), the ICMP type (for ICMP), or the EtherType.

The order of ACEs is important. When the ASA decides whether to forward or to drop a packet, the ASA tests the packet against each ACE in the order in which the entries are listed. After a match is found, no more ACEs are checked. For example, if you create an ACE at the beginning of an ACL that explicitly permits all traffic, no further statements are checked, and the packet is forwarded.

Access Control Implicit Deny

All ACLs have an implicit deny statement at the end, so unless you explicitly permit traffic to pass, it will be denied. For example, if you want to allow all users to access a network through the ASA except for one or more particular addresses, then you need to deny those particular addresses and then permit all others.

For EtherType ACLs, the implicit deny at the end of the ACL does not affect IP traffic or ARPs; for example, if you allow EtherType 8037, the implicit deny at the end of the ACL does not now block any IP traffic that you previously allowed with an extended ACL (or implicitly allowed from a high security interface to a low security interface). However, if you explicitly deny all traffic with an EtherType ACE, then IP and ARP traffic is denied.

IP Addresses Used for ACLs When You Use NAT

For the following features, you should always use the real IP address in the ACL when you use NAT, even if the address as seen on an interface is the mapped address:

• access-group command
• Modular Policy Framework match access-list command
• Botnet Traffic Filter dynamic-filter enable classify-list command
• AAA aaa... match commands
• WCCP wccp redirect-list group-list command

The following features use ACLs, but these ACLs use the mapped values as seen on an interface:

• IPsec ACLs
• capture command ACLs
• Per-user ACLs
• Routing protocols
• All other features...

Where to Go Next

For information about implementing ACLs, see the following chapters:

• Chapter 21, “Extended Access Control Lists”
• Chapter 22, “EtherType Access Control Lists”
• Chapter 23, “Standard Access Control Lists”
• Chapter 24, “Webtype Access Control Lists”