3. Configure the access control list.
ciscoasa(config)# access-list 1 extended permit ip any any
ciscoasa(config)# access-list 101 extended permit ip 192.168.10.0 255.255.255.0 any
ciscoasa# sh nameif
interface name security
gigabitethernet1/1 inside 100
gigabitethernet1/2 outside 0
ciscoasa(config)# ping 192.168.10.1
type escape sequence to abort.
sending 5, 100-byte icmpechos to 192.168.10.1, timeout is 2 seconds:
success rate is 100 percent (5/5), round-trip min/**g/max = 1/1/1 ms
ciscoasa(config)# ping 192.168.10.2
type escape sequence to abort.
sending 5, 100-byte icmpechos to 192.168.10.2, timeout is 2 seconds:
success rate is 100 percent (5/5), round-trip min/**g/max = 1/1/1 ms
ciscoasa(config)#
Experiment 1: Test inside and outside
ciscoasa(config)# sh access-list 1
access-list 1; 1 elements; name hash: 0xbbb5ca06
access-list 1 line 1 extended deny ip host 14.215.177.39 any (hitcnt=0) 0x3bcf1f89 inside forbidden ip:14215.177.39
ciscoasa(config)# sh access-list 101
access-list 101; 1 elements; name hash: 0xe7d586b5
access-list 101 line 1 extended permit ip host 14.215.177.39 any (hitcnt=0) 0x94701252 outside allowed IP: 14215.177.39
ciscoasa(config)#
Results:
Proof: If you disable the IP on inside, you won't be able to ping.
Experiment 2: Access-List 1 Extended Permit IP192168.10.0 255.255.255.0 any
access-list 101 extended permit ip192.168.10.0 255.255.255.0 any
ciscoasa(config)# sh access-list 1
access-list 1; 1 elements; name hash: 0xbbb5ca06
access-list 1 line 1 extended permit ip192.168.10.0 255.255.255.0 any (hitcnt=0) 0x8d755df7
ciscoasa(config)# sh access-list 101
access-list 101; 2 elements; name hash: 0xe7d586b5
access-list 101 line 1 extended permit ip host 14.215.177.39 any (hitcnt=0) 0x94701252
access-list 101 line 2 extended permit ip192.168.10.0 255.255.255.0 any (hitcnt=0) 0xe76cc9b5
ciscoasa(config)#
ciscoasa(config)# wr
ciscoasa(config)# reload
Still can't ping.
ciscoasa(config) access-group 101 in interface outside re**outside can ping 192168.10.1 and.
Note: Is it true that when the access-list is empty, the system will automatically delete the access-list of **?
At this point, inasaThe machine can access the Internet normally.