One of the features of Access Control Lists on Cisco ASA firewalls (available also in IOS routers), is that you can schedule when a particular ACL entry is activated. That is, a specific access-list statement will remain disabled until a specific time range is reached. This is useful in cases where you want to allow traffic access to certain servers for specific time periods. Let us see the example below where we allow access to a DMZ FTP server during only working hours (weekdays 9am to 5pm).

To configure the time range follow the steps below:

1. ASA(config)# time-range name
2. ASA(config-time-range)# periodic days-of-the-week time to [days-of-the-week] time

The parameter “days-of-the-week” can take the following values:

• monday, tuesday, wednesday, thursday, friday, saturday, sunday
• weekdays
• daily
• weekend

The parameter “time” is in the format hh:mm

The configuration is as follows:
ASA(config)# time-range working-hours
ASA(config-time-range)# periodic weekdays 9:00 to 17:00
ASA(config)# access-list FTP-ACCESS extended permit tcp any host 199.1.1.1 eq ftp time-range working-hours
ASA(config)# access-group FTP-ACCESS in interface outside
ASA(config)# static (DMZ,outside) 199.1.1.1 10.0.0.1 netmask 255.255.255.255

Related posts:

1. User Authentication for Web Server Access
2. Cisco ASA 5505 Firewall License Restriction for DMZ
3. Cisco ASA QoS for VoIP Traffic
4. How can we allow whole traffic in ASA from inside to outside
5. Configuring Connection Limits on Cisco ASA Firewalls – Protect from DoS
6. CCNA Training-Access Control Lists
7. Cisco ASA Firewall with PPPoE