Admin

Although changing an ACL on a Firewall is almost exactly like a router, there are a couple nuances that people should know. Here are some tips and best practice material.

1. When you remove an access-list, it is automatically removed from the interface. *This is a nice change from routers where you have the potential to lock yourself out.

2. Firewalls don't use wildcard masks!!!

3. Only one access-list, in one direction, is allowed on an interface.

4. Access-list are re-applied to an interface with the following syntax:

access-group [access-list name] [in / out] interface [interface name]
i.e. access-group outgoing out interface outside

5. It's a best practice to remove the entire access-list and alter it in notepad, then re-apply it to the interface.

6. As with all access-lists, the PIX reads it from top to bottom, so pay attention to the order you place your statements.

7. As with all access-lists, there is an implicit deny all statement at the end of all access-lists.

8. The syntax for a normal access-list statement is;
access-list [access-list name / number] [permit / deny] [tcp / udp/ icmp(ect)] [source] [destination] eq [port]
i.e. #access-list 12 permit 192.168.1.10 255.255.255.255 any
#access-list 101 permit tcp any host 192.168.1.24 eq telnet
# access-list blocker deny icmp any any
# access-list acl_out permit tcp any host 192.168.1.50 eq 80