Using Access
Lists
If internal users could be allowed to venture unrestricted
into less-secure areas, bringing back whatever they find, and outside access to
the network was absolutely forbidden, it might be possible to get by without
using ACLs.
The PIX Firewall is designed around the default of absolute
security, but it does allow for exceptions to be specifically configured using
access lists. By default, traffic can flow freely from inside to outside, or
from higher security to lower, except that specifically denied by an access
list. Also, by default, all traffic from the outside toward the inside, lower
security to higher, is blocked except that permitted by access lists.
Properly crafted access lists, applied to the proper
interfaces, should allow for creating just the right exceptions to maintain
acceptable security, while enabling activities that are required to further the
organization’s mission. All exceptions created with access lists should conform
to the security policy. In the next sections, you see a variety of access list
implementations.
Access-Group
Statement
Use the configuration mode access-group command to apply an access list to an interface. The
ACL is applied to inbound traffic of the interface. If the matching ACL
statement is a Permit option, PIX allows the packet. If the matching ACL
statement is a Deny option or no matching statement exists, PIX discards the
packet and generates a syslog message. Use the no form of the command to remove
the entry. The syntax is
Pix(config)# access-group acl_id in
interface int_name
Pix(config)#
no access-group acl_id in interface int_name
An access-group command always overrides the
conduit and outbound command statements for the specific interface.
The show access-group command displays the
current access list applied to interfaces.
In the following example, the static command
creates a global address of 1.1.1.3 for a DMZ web server at 192.168.2.3. The
access-list statement allows any outside host to access the global address for
the web server using port 80 (www). The access-group command
applies the access list to traffic entering the outside interface.
Pix(config)# static (dmz,outside) 1.1.1.3 192.168.2.3
Pix(config)# access-list www_ok permit tcp any host 1.1.1.3 eq www
Pix(config)# access-group www_ok in interface outside
Sections
Comments (0 posted)
Syndication
