Cisco ASA Firewall Policy & ACL
Configure access control lists and firewall policies on a Cisco ASA: inbound/outbound rules, DMZ access, service objects, and traffic inspection.
What is it?
Cisco ASA firewall policies use Access Control Lists (ACLs) applied to interfaces in a specific direction. Unlike router ACLs, the ASA is stateful — you only need to permit traffic in one direction and return traffic is automatically allowed. The ASA also uses a security-level model: traffic from higher security levels (inside=100) to lower (outside=0) is permitted by default; traffic from lower to higher requires an explicit ACL. Service objects and object-groups simplify rule management.
✓ When to use
- ·Controlling which traffic can enter your network from the internet
- ·Allowing specific services in the DMZ (web servers on 80/443, mail on 25)
- ·Blocking inbound traffic while allowing outbound from internal users
- ·Logging denied connections for security monitoring
✗ When NOT to use
- ·Application-layer inspection of encrypted traffic without SSL decryption — use FTD/Palo Alto for deep packet inspection
- ·User-based policies — ASA ACLs are IP-based; for user identity use Cisco ISE + TrustSec
How it compares
Prerequisites
- →Interfaces must be named (nameif) and have security levels assigned
- →IP addressing must be configured on all interfaces before applying ACLs
- →Understand traffic direction: ACLs are applied 'in' (inbound to the interface) or 'out' (outbound from the interface)
Config Generator
The nameif of the internet-facing interface
Leave empty if no DMZ
Public-facing server in DMZ (web server, mail server, etc.)
Verification commands
show access-listShow all ACLs with hit counts per rule
Expected: Each rule shows a hit count. Zero hits on a permit rule may mean traffic isn't reaching the ACL.
show access-groupVerify which ACLs are applied to which interfaces
Expected: Lists interface → ACL bindings for both inbound and outbound directions
show connShow active connections through the firewall
Expected: Lists established sessions. Missing connection = traffic being dropped somewhere
show service-policyVerify inspection policies are active
Expected: Shows global_policy applied globally with inspection classes active
Debug commands
packet-tracer input outside tcp <src-ip> 12345 <dst-ip> 443 detailedSimulate a packet through the firewall and show exactly which rule allows or drops it
⚠ This is a simulation only — does not send real traffic. Extremely useful for troubleshooting.
capture CAP interface outside match ip any anyCapture live traffic on an interface for inspection
⚠ Run 'no capture CAP' when done. Use 'show capture CAP' to read packets.
Common mistakes & fixes
⚡ Traffic being dropped even with a permit rule
Cause: ACL applied in wrong direction, or implicit deny at end of ACL is hitting before the permit rule
Fix: Check 'show access-list' hit counts. Use 'packet-tracer' to trace exactly where the drop occurs. Verify ACL is applied to the correct interface and direction.
⚡ Return traffic being blocked
Cause: Stateful inspection not working — usually because traffic bypassed the ASA or connection table entry expired
Fix: Check 'show conn' for the connection. Verify 'service-policy global_policy global' is configured. Check for asymmetric routing.
⚡ ACL rule order — more specific rule not matching
Cause: ASA processes ACL rules top to bottom; a broad rule earlier in the list may match before a specific one
Fix: Reorder rules using sequence numbers. More specific rules (host /32) should come before broad rules (any).
⚡ Logging not showing denied traffic
Cause: 'log' keyword missing from deny rules, or syslog not configured
Fix: Add 'log' to the end of ACL entries you want logged: 'access-list X extended deny ip any any log'