ASA Access Lists with Terraform

Automation, Cisco Networking, Networking, Terraform /

As part of the ASA API Terraform Project, in this post I will be demonstrating the creation of ACLs using objects, object groups and standard IP addressing.

Lab

I’m going to set up a simple ASA lab using the previous post from the project.

Creating Objects with Terraform

I have created a network object and an object group that references the object. The object is just for a single host that will act as my server in the DMZ.

0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
 
resource "ciscoasa_interface_physical" "gig2_dmz" {
  name           = "DMZ"
  hardware_id    = "GigabitEthernet0/2"
  interface_desc = "DMZ_TERRAFORM_CREATED"
  ip_address {
    static {
      ip       = "192.168.2.1"
      net_mask = "255.255.255.0"
    }
  }
  security_level = 10
}
 
 
 
resource "ciscoasa_static_route" "mgmt_static_route" {
  interface = "MGMT"
  network   = "10.0.0.0/8"
  gateway   = "172.16.1.254"
}
 

The next example is to create a service object and service object group for HTTP/S ports.

0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
 
resource "ciscoasa_network_service" "tcp_80" {
  name  = "TCP_80"
  value = "tcp/80"
}
 
resource "ciscoasa_network_service" "tcp_443" {
  name  = "TCP_443"
  value = "tcp/443"
}
 
resource "ciscoasa_network_service_group" "web_ports" {
  name = "WEB_PORTS"
 
  members = [
    "${ciscoasa_network_service.tcp_80.name}",
    "${ciscoasa_network_service.tcp_443.name}",
  ]
}
 

Creating ACLs with Terraform

Now the objects and groups have been created, the ACLs can be created. When creating the ACL, the ASA terraform provider will also create the binding of the ACL name to the interface.

The ACL will permit all traffic to the object-group ALL_DMZ_SERVERS using the service group WEB_PORTS.

0
1
2
3
4
5
6
7
8
9
 
resource "ciscoasa_access_in_rules" "all_dmz_servers_in_web_ports" {
  interface = "OUTSIDE"
  rule {
    source              = "0.0.0.0/0"
    destination         = "${ciscoasa_network_object_group.all_dmz_servers.name}"
    destination_service = "${ciscoasa_network_service_group.web_ports.name}"
  }
}
 

The ASA config will look like below…

Testing with Packet Tracer

The ACL on the ASA is working as confirmed with the packet-tracer command. I have omitted some of the output, as it’s not really necessary.

INSIDE to DMZ ACL

I’ll quickly create one more ACL that will permit traffic from the INSIDE to the DMZ segment. For this, I will use object-groups only, but with hard set ports and addresses in them. The ACL itself will also contain a hard set ACL.

This ACL permits port 22 from the INSIDE host 192.168.1.5 to the DMZ group ALL_DMZ_SERVERS, which currently contains a single host of 192.168.2.5.
Terraform created the access-group and the object group for SSH_PORT

0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
 
resource "ciscoasa_network_object_group" "all_inside_servers" {
  name = "ALL_INSIDE_SERVERS"
 
  members = [
    "192.168.1.5",
  ]
}
 
 
resource "ciscoasa_network_service_group" "ssh_port" {
  name = "SSH_PORT"
 
  members = [
    "tcp/22",
  ]
}
 
resource "ciscoasa_access_in_rules" "inside_dmz_ssh" {
  interface = "INSIDE"
  rule {
    source              = "192.168.1.5"
    destination         = "${ciscoasa_network_object_group.all_dmz_servers.name}"
    destination_service = "${ciscoasa_network_service_group.ssh_port.name}"
  }
}
 

Leave a Comment

Your email address will not be published. Required fields are marked *