ASA Global access list

Posted: July 21, 2014 in Cisco Security - Firewalls

Global access list applies logically to the entire firewall in inbound direction to all interface.
If there are existing interface access lists, those will be considered first and instead of having implicit deny any any at the end of interface ALCs, the Global access list is processed and in case of non-matching rule, the implicit deny any any is used at the end of Global access list.

To create global access list using asdm open access rule, add access rule, and for interface choose -Any-

To create global access list using CLI:

#access-list GLOBAL extended permit tcp any any
#access-group GLOBAL global

ACL overrides initial traffic flow policies based on security level: 100- the most trusted and 0 – not trusted.
By default traffic from higher to lower sec level is allowed but not from lower to higher. For this type of traffic we need ACL.
Global access list are not replicated on each interface so they save memory space.

Use packet-trace to check the rule:
packet-tracer input VLAN49 tcp 20000 21

#show access-list
#show access-group

  1. Rajesh says:

    Thanks for posting global access policy through command line

  2. Vlad says:

    What is the difference in the use of access lists on the interface and global mode (with an explicit deny ip any any) on cisco ASA 9,x from the point of view of safety and resources?

    • Global ACL will be applied to ALL interfaces in inbound direction. It is easy way of applying a set of ACL to the firewall. On the other hand, firewall can fulfill more detailed control features using ACLs on individual interfaces. Each interface can have two ACL applied: on inbound and one outbound. So this will provide more robust and detailed security options but will provide a bit more burden on firewall resources. If you spec your firewall correctly for the job it will be doing, you will not have any issues with two ACLs per interface. Regardless of the way firewall presents the ACLs lists to the admin user (using objects, service groups, etc) firewall still has to break down the objects and do one line of ACL at the time.
      From the security standpoint, more ALCs means more granular control but on the other hand, more admin work. I haven’t seen firewall struggling with performances when dealing with ACLs; i saw badly configured firewall struggling to keep up with DoS or DDoS attacks but not with ACLs.
      By default firewall will deny any traffic that is not allowed; that being said explicit deny any any at the end of ACL will provide you with hit count entries in ACL (or in log collector) so you can get more info about traffic trying to go thru your firewall, source and destinations hosts. Again, no burden on firewall with this additional line.
      Thanks for following.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s