Cisco Security Cloud Control: Secure Firewall ASA Management

PDF

Cisco Security Cloud Control: Secure Firewall ASA Management

Manage ASA network security policy

Updated: July 17, 2026

Want to summarize with AI?

Log in

Learn how to manage ASA network security policy, including rule order, interface assignment, logging, search, and deployment considerations.

The ASA network security policy includes access control lists (ACLs) that determine whether to permit or deny traffic from accessing another network through the ASA firewall. This section outlines the steps to create an ASA access list and configure access rules within it. It also details the steps to assign an interface to an access control list and share it among other ASA devices managed by Security Cloud Control Firewall Management.

About ASA Access Control Lists and Access Groups

ASA Access Control Lists

Access control lists (ACLs) are used to identify traffic flows based on various characteristics such as source and destination IP address, IP protocol, ports, source, and other parameters.

The following is an access list sample:

access-list ACL extended permit ip any any

ACL is the name of the access list.

You can avoid the creation of the same access list on multiple devices individually, and instead create a single access list and share it across multiple ASA devices. Changes made to the shared access list automatically apply to all the devices to which the ACL is assigned. You also have the option to copy the access list to other ASA devices as needed.

Access Rules

An access list includes access rules that permit or deny traffic flow to a network based on specific characteristics such as source and destination IP addresses, IP protocol, port number, and security group tags.

ASA Access Groups

An access group is a specific association that is established when an access list is assigned to a device interface configured for traffic flow in any direction. The access list contains specific rules that either permit or deny traffic passing through the device interface.

The following is an access group sample that is created when a device interface is assigned to an access list.

access-group ACL out interface giginterface0

ACL is the name of the access list and giginterface0 is the logical name of the device interface that is assigned to the access list.

Note

To use API endpoints to manage your ASA access groups, see Get Access Groups on the Cisco DevNet website.

Create an ASA Access List

When configuring an access list on an ASA firewall, a rule is automatically created to allow traffic from a source to a destination outside your network. You can create additional rules and assign the access list to an interface to regulate the traffic network.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

Click Create Access List.
5.

In the Name field, enter a name for the access list and click Save.

Note

You cannot have two access lists with the same name on a device.
6.

Click Save.

Security Cloud Control creates an access group and a default rule that permits all traffic.

You can now add new rules to the access list. See Add a Rule to an ASA Access List.

What to do next

Add a Rule to an ASA Access List

You can add rules in ascending order by rule number. Packets will be verified against the rules in the sequence in which the rules were created, with the first rule taking precedence, followed by subsequent rules. You can adjust the position of any rule, if required.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, select an access list that you want.
5.

Click the Add Rule () icon that is displayed on the right.

Note

In the ordered list, hover over the desired position and click Add Rule Here.
6.

In the New Access Rule window, provide the following information:

  • Order: Select where you want to insert the rule in the ordered list of rules. Rules are applied on a first-match basis and prioritized by position in the list of rules from 1 to last.

  • Action: Specify whether you are allowing (permitting) the described traffic or are blocking (dropping) it.

  • Protocol: Specify the protocol of the traffic, such as IP, TCP, UDP, ICMP, or ICMPv6. The default is IP, but you can select a more specific protocol to target traffic with more granularity.

  • Source/Destination: Define the source (originating address) and destination (target address of the traffic flow). You typically configure the IPv4 address of hosts or subnets, which you can represent with network object groups. You can assign only one object to the source or destination.

    To create a new network object or group, see Create or Edit ASA Network Objects and Network Groups.

  • Port: Select the port object that pairs a service type, such as TCP or UDP, and a port number or a range of port numbers.

  • SGT Group: Assign the security group you want from the list. By default, the value is Any. See Security Group Tags in ASA Policies.

  • Time Range: Define a time range for ASA network policies to allow access to networks and resources based on time of day.

    See ASA Time Range Objects.

  • Logging: Activity resulting from a network policy rule is not logged by default. You can activate logging for individual rules. See Log Rule Activity.
7.

Click Save.

The rule is added to the access list and set to Active state.
8.

Review and deploy the changes you made now, or wait and deploy multiple changes.

About System Log Activity

When you set up a new rule, you can specify how often and at what severity level you want to collect its activity. To do this, you can select the corresponding severity levels and then choose the frequency of data collection. This will ensure that you have the necessary information to monitor and analyze the activity generated by your rules.

Note

ASA does not generate syslog messages with a severity level of zero (emergencies).

You have the option to adjust the logging interval, which indicates how frequently the log records are updated. This interval is measured in seconds and can be set from 1 to 600. By default, the interval is set to 300 seconds. This interval value is also utilized as a timeout period for removing an inactive flow from the cache that collects drop statistics.

Table 1. Log Rule Activity

Security Level

Description

emergencies

System is unusable.

alert

Immediate action is needed.

critical

Critical conditions.

error

Error conditions.

warning

Warning conditions.

notification

Normal but significant conditions.

informational

Informational messages only.

debugging

Debugging messages only.

Deactivate Rules in an Access Control List

When you create a new rule in an access control list, it is activated by default. However, you can temporarily deactivate individual rules to optimize traffic flow, resolve conflicts, or isolate issues.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.

4.

From the Selected Access List drop-down list, choose the access control list you want.
5.

In the rule list, check the corresponding rule check box that you want.

6.

In the selected row, slide the Active setting off.
7.

Review and deploy the changes you made now, or wait and deploy multiple changes.

About Security Group Tags in ASA Policies

If you onboard an ASA that uses security group tags (SGT) in its access control rules, Security Cloud Control allows you to edit the rules that use SGT groups and manage the policies that have these rules. However, you cannot create SGT groups or edit them using the Security Cloud Control GUI. To create or edit SGT groups, you must use ASA's Adaptive Security Device Manager (ASDM) or the CLI available in Security Cloud Control.

In Security Cloud Control's object page, when looking at the details of SGT groups, you'll see that those objects are identified as noneditable, system-provided objects.

Security Cloud Control administrators can perform these tasks on ACLs and ASA policies that contain SGT groups:

  • Edit all aspects of ACLs except the source and destination security groups.

  • Copy a policy containing SGT groups from one ASA to another.

For detailed instruction, on configuring Cisco TrustSec using the command line interface, see the "ASA and Cisco TrustSec" chapter of the ASA CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide pertaining to your ASA release.

Assign Interfaces to ASA Access Control List

When you assign ASA interfaces to access control list, the device establishes a specific association between the list and interfaces. The rules that are associated with access control list are applied only to the interfaces through which the traffic flows in the specified directions.

You can only assign one access list per interface for a single traffic flow direction.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, choose an access list.
5.

In the Actions pane displayed on the right, click Assign Interfaces.

6.

From the Interface drop-down list, choose an interface.
7.

From the Direction drop-down list, specify the direction for applying the selected access list.

The designated access list is applied to the interface through which traffic flows in the specified direction. This access list can be applied to multiple interfaces and directions.

To apply the access list to all the interfaces on the ASA device, see Create an ASA Global Access List.
8.

Click Save.
9.

Review and deploy the changes you made now, or wait and deploy multiple changes.

Create an ASA Global Access List

Global access policies are network policies that are applied to all the interfaces on an ASA. These policies are only applied to inbound network traffic. You can create a global access policy to ensure that a set of rules is applied uniformly to all the interfaces on an ASA.

Only one global access policy can be configured on an ASA. However, a global access policy can have more than one rule assigned to it, just like any other policy.

This is the order of rule-processing on the ASA:

  1. Interface access rules

  2. Bridge Virtual Interface (BVI) access rules

  3. Global access rules

  4. Implicit deny rules

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, choose an access list.
5.

In the Actions pane displayed on the right, click Assign Interfaces.

6.

Check the Create as a global access list check box.
7.

Click Save.
8.

Review and deploy the changes you made now, or wait and deploy multiple changes.

Share an ASA Access Control List with Multiple ASA Devices

Sharing access policies in network security effectively improves efficiency, consistency, and centralized management, leading to an overall improved security posture. To share an access control list across ASA devices, create an access control list and define access rules on a single ASA device and then share it with the desired ASA devices rather than configuring them separately. This ensures consistency in the network and reduces the risk of misconfigurations. Additionally, shared access control lists provide scalability because networks grow and evolve by allowing you to manage access control lists for increasing users and ASA devices.

Keep the following points in mind:

  • Access control list rules are shared, but the interfaces are not included.

  • Sharing an access control list with other ASA devices will overwrite any existing access control lists with the same name.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, choose an access control list.

5.

In the Actions pane that is displayed on the right, click Share.
6.

Select the ASA devices by checking the corresponding check box and click Save.

In the Device Relationships pane displayed on the right, the ASA devices that share the selected access control list are displayed.
7.

Review and deploy the changes you made now, or wait and deploy multiple changes.

Copy an ASA Access Control List to Another ASA

An ASA access control list can be easily copied to another Security Cloud Control-managed device in the same tenant. After copying an access list file to a target ASA device, any further changes made to the access list won't be automatically applied to the target device. This is different from access control list sharing feature, where changes are automatically applied.

Keep the following points in mind:

  • You cannot copy an access list to a target device if that device already has another access list with the same name.

  • You cannot copy an access list if another access list on the target device is associated with the same interface and direction.

  • You cannot only copy an access list to a disabled interface on the target device.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, choose an access list.
5.

In the Actions pane on the right, click Copy.

6.

Select the target device to which you want to copy the access list.
7.

Choose an interface and specify the direction for applying the selected access list.

The designated access list is applied to the interface through which traffic flows in the specified direction. This access list can be applied to multiple interfaces and directions.

To apply the access list to all the interfaces on the selected target, see Create an ASA Global Access List.

8.

Click Copy.

A message appears at the bottom right corner on the Security Cloud Control screen on a successful copy.
9.

Review and deploy the changes you made now, or wait and deploy multiple changes.

Copy a Rule Within or Across ASA Access Lists and Devices

You can copy an access control rule in the following ways:

  • Within the same access list.

  • From one access list to another, either within the same ASA device or across different ASA devices.

Note

The paste operation fails if you attempt to add a rule that already exists in the access list.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, select an access list that you want.
5.

Select a rule by clicking the corresponding check box and in the Actions pane on the right, click Copy.
6.

Perform the following:

  • To paste the rule within the same access list, hover the mouse pointer in the desired position until you see the Paste Rule Here option and click it. The Add/Edit rule dialog box is displayed, allowing you to modify the copied rule, as identical rules are not permitted in the same access list.
  • To paste the rule within the same ASA device, from the Selected Access List drop-down list, select an access list you want.
  • To paste the rule to a different ASA device, in the left pane, go to Security Devices > select an ASA device > Policy > Selected Access List.
7.

To paste the copied rule in the desired position, select a rule that comes after where you want the new rule to be. In the Actions pane on the right, click Paste. The copied rule will be inserted before the selected rule.

You can use the Move Up and Move Down buttons to position the rule as needed.

Note

Alternatively, you can hover over a desired position in the rule listing table until you see Paste Rule Here, and then click it.

Unshare a Shared ASA Access Control List

If the rules governing the interface handling your network become outdated, you can unshare the access control list from the devices currently linked. Unsharing an ASA device from the shared access control list will not have any impact on other ASA devices currently sharing this list.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, choose an access list.
5.

In the Actions pane on the right, click Share.
6.

Uncheck the ASA devices that share the selected access list and click Save.

7.

Review and Deploy the changes you made now, or wait and deploy multiple changes.

View ASA Access Policies Listing Page

The ASA access policy listing page shows a comprehensive overview of all access lists associated with the ASA devices that have been onboarded to the Security Cloud Control tenant.

Note

Click the filter () button, then click Filter by Device to search for policies that are either shared across multiple ASA devices or specific to a single ASA device.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Policies > ASA > Access Policies.

The page provides the following information:

  • Name: The name of the access list.

  • Device: The corresponding ASA devices associated with each access list. Additionally, for access lists that are shared across multiple devices, it displays a list of all ASA devices that use the shared access list.

    Click the button to view the ASA devices associated with the selected access list.

    To navigate to the policy page of the selected device, click View Policies. You can create or edit an access list.

    To return to this page, click ASA Access Policies.

  • Interfaces: The network interfaces to which each access list is assigned.
3.

To view the ASA devices associated with an access list, click the corresponding button in the Device column.
4.

To navigate to the policy page of the selected device, click View Policies. You can create or edit an access list.

5.

To return to the policy listing page, in the top-left corner, click ← ASA Access Policies.

Global Search of ASA Access Lists

Use the global search functionality to search the following in your Security Cloud Control tenant:

  • ASA devices and all their associated access lists.

  • Access lists or shared access lists and their occurrences across all onboarded ASA devices.

See more: global search.

Rename an ASA Access Control List

It is possible to modify the name of an access list to suit your specific needs. Whether you want to rename a global access list or a shared access control list, it is a straightforward process. If the access list is shared, changing its name updates the name on all the other devices where the shared access control list is used. Remember that the updated name will only reflect after the configuration is deployed to those devices.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

From the Selected Access List drop-down list, choose an access list that you want to rename.
5.

Click the Rename () icon in the right pane.
6.

Click the Save () button.
7.

Review and deploy the changes you made now, or wait and deploy multiple changes.

Delete a Rule from an ASA Access Control List

You can remove access rules from the access list, but at least one rule must remain for the list to exist.

Procedure

1.

In the left pane, click Security Devices.

2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane on the right, click Policy.
4.

Click an access list and select the rules to be deleted.
5.

In the Actions pane on the right, click Remove.
6.

Review and deploy the changes you made now, or wait and deploy multiple changes at once.

Delete an ASA Access Control List

This procedure can be used to delete the access control list, shared access list, or a global access list. Deleting a shared access list from one device does not impact other devices where the access list is in use. On those devices, the access list persists as a local access list.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab and select an ASA device by checking the corresponding check box.
3.

In the Management pane displayed on the right, click Policy.
4.

From the Selected Access List drop-down list, choose an access list you want to delete.
5.

In the Actions pane on the right, click Delete.
6.

Review and deploy the changes you made now, or wait and deploy multiple changes at once.