Filter
Top Products
7-4
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter 7 Configuring Access Rules
Information About Access Rules
Note “Inbound” and “outbound” refer to the application of an ACL on an interface, either to traffic entering
the ASA on an interface or traffic exiting the ASA on an interface. These terms do not refer to the
movement of traffic from a lower security interface to a higher security interface, commonly known as
inbound, or from a higher to lower interface, commonly known as outbound.
An outbound ACL is useful, for example, if you want to allow only certain hosts on the inside networks
to access a web server on the outside network. Rather than creating multiple inbound ACLs to restrict
access, you can create a single outbound ACL that allows only the specified hosts. (See Figure 7-1.) The
outbound ACL prevents any other hosts from reaching the outside network.
Figure 7-1 Outbound ACL
Transactional-Commit Model
The ASA rule-engine supports a new feature for rule updation called the Transactional-Commit Model.
When this feature is enabled, a rule update is applied after the rule compilation is completed; without
affecting the rule matching performance. With the legacy model, rule updates take effect immediately
but rule matching slows down during the rule compilation period. This feature is useful to prevent
potential packet drops during large compilation of rules under high traffic conditions. This feature is also
useful to reduce the rule compilation time under two specific patterns of configurations:
• Preventing packet drops while compiling large rules during high traffic rates.
• Reducing rule compilation time while updating a large number of similar rules.
Web Server:
209.165.200.225
Inside
HR
Eng
Outside
Static NAT
209.165.201.410.1.1.14
Static NAT
209.165.201.610.1.2.67
Static NAT
209.165.201.810.1.3.34
ACL Outbound
Permit HTTP from 10.1.1.14, 10.1.2.67,
and 10.1.3.34 to 209.165.200.225
Deny all others
ACL Inbound
Permit from any to any
ACL Inbound
Permit from any to any
ACL Inbound
Permit from any to any
ASA
333823