One of the features of Access Control Lists on Cisco ASA firewalls (available also in IOS routers), is that you can schedule when a particular ACL entry is activated. That is, a specific access-list statement will remain disabled until a specific time range is reached. This is useful in cases where you want to allow traffic access to certain servers for specific time periods. Let us see the example below where we allow access to a DMZ FTP server during only working hours (weekdays 9am to 5pm).

To configure the time range follow the steps below:

1. ASA(config)# time-range name
2. ASA(config-time-range)# periodic days-of-the-week time to [days-of-the-week] time

The parameter “days-of-the-week” can take the following values:

• monday, tuesday, wednesday, thursday, friday, saturday, sunday
• weekdays
• daily
• weekend

The parameter “time” is in the format hh:mm

The configuration is as follows:
ASA(config)# time-range working-hours
ASA(config-time-range)# periodic weekdays 9:00 to 17:00
ASA(config)# access-list FTP-ACCESS extended permit tcp any host 199.1.1.1 eq ftp time-range working-hours
ASA(config)# access-group FTP-ACCESS in interface outside
ASA(config)# static (DMZ,outside) 199.1.1.1 10.0.0.1 netmask 255.255.255.255

Related posts:

1. User Authentication for Web Server Access
2. Cisco ASA QoS for VoIP Traffic
3. Cisco ASA 5505 Firewall License Restriction for DMZ
4. Configuring Connection Limits on Cisco ASA Firewalls – Protect from DoS
5. How to Configure VLAN subinterfaces on Cisco ASA 5500 Firewall
6. Cisco ASA Firewall with PPPoE
7. How to Configure a Cisco ASA 5510 Firewall – Basic Configuration Tutorial