Equipment Support > Hardware By Brand > Cisco > ASA behind a router

ASA behind a router

access-list ***OUTSIDE***_access_in; 12 elements; name hash: 0x19c65742
access-list ***OUTSIDE***_access_in line 1 extended permit object-group DM_INLINE_PROTOCOL_1 any any 0x15a9feec
  access-list ***OUTSIDE***_access_in line 1 extended permit ip any any (hitcnt=13100758) 0x08f835d0
  access-list ***OUTSIDE***_access_in line 1 extended permit esp any any (hitcnt=0) 0xa667c7c2
access-list ***OUTSIDE***_access_in line 2 extended permit udp any any eq isakmp (hitcnt=0) 0xd5fa0626
access-list ***OUTSIDE***_access_in line 3 extended permit udp any any (hitcnt=0) 0x02eb084b
access-list ***OUTSIDE***_access_in line 4 extended permit ah any any (hitcnt=0) 0xbbdad6c7
access-list ***OUTSIDE***_access_in line 5 extended permit icmp any any traceroute (hitcnt=0) 0x78c75d57
access-list ***OUTSIDE***_access_in line 6 extended permit tcp any object-group SMB any 0x2ec4a14f
  access-list ***OUTSIDE***_access_in line 6 extended permit tcp any eq 445 any (hitcnt=0) 0x5c9f51d2
access-list ***OUTSIDE***_access_in line 7 extended permit tcp any any eq citrix-ica (hitcnt=0) 0x89b2e0b6
access-list ***OUTSIDE***_access_in line 8 extended permit icmp any any echo-reply (hitcnt=0) 0xe3a73d39
access-list ***OUTSIDE***_access_in line 9 extended permit icmp any any unreachable (hitcnt=0) 0x5b986655
access-list ***OUTSIDE***_access_in line 10 extended permit icmp any any time-exceeded (hitcnt=0) 0x863aac3e
access-list ***OUTSIDE***_access_in line 11 extended permit icmp any any echo (hitcnt=0) 0xd1d2929d
access-list ***OUTSIDE***_access_in line 12 extended permit tcp any any eq 1433 (hitcnt=0) 0xe15f040d
 ..
 

I would say its most likely because of this rule:

access-list ***OUTSIDE***_access_in line 1 extended permit ip any any
 

reply to Teddzy
Try this FAQ entry.

Regards

@ Toms: Thanks for the insight to the problem, i guessed as much, that's where it lies. I wanted to sound the opinion of another pro in the game. I appreciate. But asking where by that permit ip any any is associated to an IPS module installed on the ASA passing traffic to the IPS module for inspection. I guess this is where it gets a bit complicated. One thing i think i'll do is to know the exact traffic i need to pass to the IPS model to inspect.

@ Hell, bro you are a life saver.....oh! Tom you are too hehehe! the link is just what i needed to go via! Thanks a lot bro!

Guys thanks!!!

Ted

reply to Teddzy
Better if you can post your full config, minus passwords and other sensitive info, for review.

If you're trying to send data to the IPS, IIRC you don't do it via an ACL but a policy map.
You may want to check Cisco for config guides on how to do this, or supply the config and
we can take a look.

Regards

For some people that have always been working using CLI, using GUI confuse them a lot not to mention slow down the work

Here is why. First, PIX GUI was used to be unreliable. With today's ASA GUI (which is much reliable), you cannot really see every piece of configuration on the same display since you have to go through several menus to get an idea of how or why the ASA was configured such.

Second, to make changes on the ASA GUI you again may have to go through several menus (depending on what you are doing) not to mention the wait time of the ASA to save configuration changes. With CLI and proper planning, you can simply copy and paste your changes plus save the work that may only take 1 minute

On the other hand, auditors and some security people love GUI since they are showing nice color and display (which was one of the reason Checkpoint was popular then). Also you have write access through GUI even though you don't have write access through CLI

I myself enjoy using GUI for those IDS/IPS management since it would be simple work in reviewing Signature Definitions and rules. Other than those I tend to use CLI as often as possible

Be careful with Juniper GUI, since it may suffer the same problem with old PIX GUI which was unreliable. One of a coworker used GUI to make changes on some SRX firewall. The changes was about inserting/adding/moving permit rule. From the GUI perspective, the rule was in place. However when the traffic flow test was conducted, no traffic was flowing. When I had him log in using CLI, he found out that the change was not in place.

I myself never used Juniper GUI (either SRX, SSG, or even the old Netscreen). I always used JUNOS or ScreenOS CLI. So this Juniper GUI unreliability thing is kind of surprising

 policy-map global_policy
        class MR-IPS-TRAFFIC
      class-map MR-IPS-TRAFFIC
      access-list IPSTRAFFIC extended permit ip any any
 ..
 

reply to Teddzy
Which version of ASA code are you running? You may want to look at here for a guide,
but off the top of my head, you're missing the section of commands that actually tell
the ASA to send the matched traffic to the ips, namely

 ips inline | promiscuous ...
 

Hey Hell,

Thanks for that, i actually omitted that while i sent you earlier config, i do have it inline anyways.

 ips inline fail-open
 

reply to Teddzy
Just to doublecheck, can you post the full config, minus any passwords or sensitive info?

Far as I know, that's all you need to tell the ASA to send traffic to the IPS sensor is
a class-map / policy-map config.

Regards

reply to Teddzy

reply to Teddzy

Hello Aryoba,

Thanks for your reply, i have noted your design which makes sense enough. I will definitely put that into big consideration. The 2811 i should say has enough security futures. I might as well set it up for a Zone Based Firewall and allow everything we need to come through.

Thanks for the suggestion. Phew thanks a lot.

Teddy