On Thu, 2014-10-09 at 19:42 +0000, Christopher Werny wrote: > I am wondering, does return traffic (for connections originated on the > inside network) get through the ASA with the explicit deny ip any any > statement in the outside ACL? I know it works without an ACL applied > to the outside interface, but the explicit deny got me thinking. I > haven't a device with me to test it unfortunately
It's allowed. Generally speaking, only packets that initiate new connections are subjected to the access-list rules. All applicable access-lists (e.g. both inbound on inside and outbound on outside for a packet moving from inside to outside) must allow the connection, but when it has been allowed then access-lists are not considered for subsequent related packets. If you're familiar with iptables then you can compare this to having an implicit "-m state --state ESTABLISHED,RELATED -j ACCEPT" rule before anything else. -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
