As discussed in Chapter 5, "Network Access Control," you can use access control lists (ACLs) to filter traffic passing through Cisco ASA. You can set up a traffic-filtering ACL under Configuration > Features > Security Policy > Access Rules. Click Add to create a new ACL. Figure 19-1 shows a new access control entry (ACE) added into ASDM to block web traffic coming in from the outside host located at 188.8.131.52 to an inside web server located at 184.108.40.206. This ACE is a part of an ACL, which is automatically created by ASDM and applied to the interface. ASDM provides a nice Rule Flow Diagram section to illustrate how the ACL policy will be applied to the traffic. The source or destination host/network addresses may be IP addresses, an interface name, or an object group. You may also enter a description at the bottom of the screen to label the purpose of this entry.
Figure 19-1. Setting Up an ACE
An ACE is referred to as an access rule in the ASDM interface.
Figure 19-2 illustrates the complete ACL with two ACEs.
Figure 19-2. Displaying the Entire ACL
The first entry denies the traffic originating from the host located at 220.127.116.11. The second entry allows web traffic to pass through Cisco ASA if it is either of the following:
Example 19-1 shows the corresponding ACL generated by ASDM. The ACL name is outside_access_in and it is applied to the outside interface in the inbound direction.
Example 19-1. ACL Generated by ASDM
access-list outside_access_in remark ACE to block web-traffic destined to 18.104.22.168 from 22.214.171.124 access-list outside_access_in extended deny tcp host 126.96.36.199 host 188.8.131.52 eq www access-list outside_access_in extended permit tcp any host 184.108.40.206 eq www access-group outside_access_in in interface outside
The use of object groups can simplify both the CLI and GUI configuration if numerous hosts need to be filtered using similar properties. For network-based object groups, Cisco ASA needs to know where a host or a network exists. To accomplish this, navigate to Configuration > Features > Building Blocks > Host/Networks and then click Add under Hosts/Networks Groups. You can enter the IP addresses of the hosts either by clicking Existing Hosts and Networks and adding them from the list or by clicking New Host or Network, typing the new address, and then adding it with the Add button, as shown in Figure 19-3. The existing hosts are the previously added hosts in the ASDM list. The administrator has named this object group inside_web_servers and has grouped three inside IP addresses in the list.
Figure 19-3. Defining an Object Group in ASDM
After defining the object groups, you can map an ACE, as shown in Figure 19-4. The traffic from the outside hosts defined in the outside_hosts network group is allowed to pass through Cisco ASA to the hosts on the inside network that are identified in the inside_web_servers group on TCP port 80.
Figure 19-4. Mapping an Object Group in ASDM
Example 19-2 shows the configuration generated by ASDM when using object groups.
Example 19-2. ACL with Object Groups Generated by ASDM
object-group network inside_web_servers network-object 220.127.116.11 255.255.255.255 network-object 18.104.22.168 255.255.255.255 network-object 22.214.171.124 255.255.255.255 object-group network outside_hosts network-object 126.96.36.199 255.255.255.255 network-object 188.8.131.52 255.255.255.255 network-object 184.108.40.206 255.255.255.255 access-list outside_access_in line 1 extended permit tcp object-group outside_hosts object-group inside_web_servers eq 80 access-group outside_access_in in interface outside
Using ASDM, you can configure a security Cisco ASA to filter ActiveX and Java applets from the traffic passing through it. To set this up, choose Configuration > Features > Security Policy > Filter Rules, which results in the window shown in Figure 19-5. Here, Cisco ASA is being set up to filter ActiveX code from the web requests that originated from the inside network 220.127.116.11/27 and are destined for any address on the outside network.
Figure 19-5. Content Filtering
Part I: Product Overview
Introduction to Network Security
Part II: Firewall Solution
Initial Setup and System Maintenance
Network Access Control
Authentication, Authorization, and Accounting (AAA)
Failover and Redundancy
Quality of Service
Part III: Intrusion Prevention System (IPS) Solution
Intrusion Prevention System Integration
Configuring and Troubleshooting Cisco IPS Software via CLI
Part IV: Virtual Private Network (VPN) Solution
Site-to-Site IPSec VPNs
Remote Access VPN
Public Key Infrastructure (PKI)
Part V: Adaptive Security Device Manager
Introduction to ASDM
Firewall Management Using ASDM
IPS Management Using ASDM
VPN Management Using ASDM