topic Re: deny internet access on our domain controller in Network Access Control

deny internet access on our domain controller

VOLUS — Tue, 12 Jul 2022 10:11:15 GMT

i have installed firepower on my ASA 5516 as SFR module,

i am using ASDM to manage rules ,

any idea how to block internet access on my domain controller, and please note that this domain controller is the DNS server.

I tried deny any any on DCs IP addresses than I allowed port 53 and didn't work .

balaji.bandi — Tue, 12 Jul 2022 10:23:17 GMT

Is this FW also facing Internet and you do NAT ?

on your DC DNS Server, what DNS server external configured ?

so your rule should allow

Source : your local DNS

Destination : 8.8.8.8 4.4.4.4

service 53 allow.

example :

VOLUS — Tue, 12 Jul 2022 10:29:05 GMT

hello,

can you please share the config from firepower and not ASA as i redirected all traffic to firepower

Kasun Bandara — Tue, 12 Jul 2022 11:09:46 GMT

Check below guide of configuration.

make sure you are sending all traffic via FP module using ASA service policy