topic Re: Deny connection from specific ouside IP to specific inside IP in Network Security

Deny connection from specific ouside IP to specific inside IP

vladimirguan — Fri, 21 Feb 2020 15:19:57 GMT

Hi All,

I have an ASA 5540 which I want to block certain outside IPs say, 10.190.1.0/24 to access certain inside IP, say 10.199.10.5. Can I achieve this with an ACL? I can do it with the firewall at 10.199.10.5 but prefer for it to be all done inside the ASA.

TIA,

Vlad

Re: Deny connection from specific ouside IP to specific inside IP

Francesco Molino — Mon, 12 Feb 2018 03:24:50 GMT

First of all, to allow outside subnets (from internet?) To access inside, you have to Nat your inside host to a public ip to allow remote public hosts to find the route to access your network.

Once done, you can then add an ace into your outside acl to allow specific public subnet to access your internal host.

Is that explanation clear?

In terms of config example, let's say you will nat your host to public ip 1.1.1.1 and your outside acl is called outside_in

Object network InsideHost

host 10.199.10.5

nat (inside,outside) static 1.1.1.1

object group PublicAuthzInsideHost

subnet 10.190.1.0 255.255.255.0

access-list outside_in extended permit ip object PublicAuthzInsideHost object InsideHost

Re: Deny connection from specific ouside IP to specific inside IP

vladimirguan — Mon, 12 Feb 2018 05:45:48 GMT

Hi Francesco,

Thank you for the reply but I do not want to use NAT and our IOS is 8.0 so no chance of adding the objects required. I have resorted to modifying the individual inside servers' firewalls to block the outside IP ranges.

Cheers,

Vlad

Re: Deny connection from specific ouside IP to specific inside IP

vladimirguan — Mon, 12 Feb 2018 06:12:29 GMT

I just realised there was a way to do this which is via routes. So basically, create a route for the outside interface to route specific IP addresses to 0.0.0.0.