MicroNugget: What is the Global ACL Feature on the ASA Firewall?

In this video, Keith Barker covers the new Global Access Control List feature on ASA firewalls. The only perfect way to keep your internal networks safe from unsafe intrusion is to never connect to any external networks. Since that's rarely possible, see how global ACLs keep large networks secure.

Hypothetically, suppose you've got 50 different interfaces and need to allow or permit some common traffic on all 50 of them. With a global ACL, you can make one rule that applies to all those interfaces.

To demonstrate, Keith inspects a DMZ, or demilitarized zone’s path to the internet. On that perimeter network server, we can assign rules for what outside traffic is permitted to bypass the ASA.

By default, initial traffic doesn’t flow from low security to higher security interfaces. That means if an inbound packet is destined for a higher security level interface, the ASA is never going to push that water uphill.

An ACL says, “Please permit traffic from anywhere on the internet, if its destination is our DMZ server, and its destination port is TCP 80 (web services).”

As you add more interfaces and have more users on each one of them, you’d need an access list for each one. Unless you master using a global ACL: then you don’t have to individually assign each interface.

Start learning with CBT Nuggets:

[cbtnuggets]

Yes, after he finishes CCNP Security Firewall he starts working on CCNP Security VPN. Ketih is currently working through series very quickly. I would expect to see both finished by the beginning of November.

[cbtnuggets]

Right now Keith is halfway through finishing a new series for CCNP Security. It should be finished within a few weeks. If you have an annual subscription you can check out the first 10 videos now.

[somalistudent]

Great demonstration. I like it bectause it works! :) Is he going to update all CCNP Security Exam Series? or only the Firewall ? Please let me know that soon. I am big fan of both Keith & CBT

[andrewbromfield]

Great as always Keith. Do you plan on updating the CCNP Security track with CBT Nuggets?

[jasonworingen]

Are we limited to a single global rule that must be edited if different but additional, destination IPs/ports are needed?

e.g.
Sources = IANA addresses
Destination = [First task today] 203.0.113.45 tcp 80
Destination = [Second task next month] 198.51.100.76 tcp 1024

[bigbos]

one question about acl in ASAv, I have to open both way to make connection from internal to dmz interface, if i open one direction it's not work? not just like other statefull firewall. any advice for this problem?