topic Re: Hi Jon, in Network Security

Block external subnet with asa

mspdog22 — Tue, 12 Mar 2019 07:53:08 GMT

Hello

I have a cisco asa 5510 and would like to block a public subnet.

Could some tell me how i can block a whole subnet with an access list.

Thanks

Jon

Hi Jon,

Aditya Ganjoo — Tue, 14 Jun 2016 16:03:39 GMT

Hi Jon,

You can use the deny statement on the outside access-list applied in the out direction on the interface.

You can also use the shun command to deny the public IP subnet.

shun x.x.x.x netmask x.x.x.x

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Not sure i understand.

mspdog22 — Tue, 14 Jun 2016 16:20:24 GMT

Not sure i understand.

Could you post a sample config of the access list.

Thanks

I am trying to block our

mspdog22 — Tue, 14 Jun 2016 16:28:48 GMT

I am trying to block our inside users from being able to access Netflix.

I have all the subnet that Netflix owns and there ip space.

I plan to build and access list that will block all traffic from inside to outside interface.

create object group and

OPRoger — Tue, 14 Jun 2016 16:47:13 GMT

create object group and include all netflix ip,=>deny (source any destination netflix-subnet service IP ) apply in your internal or DMZ interface depend on your traffic route

Hi,

Aditya Ganjoo — Wed, 15 Jun 2016 00:43:14 GMT

Hi,

You need to apply the access-list on the inside interface as shown in this example:

Block the HTTP port traffic:

In order to block the inside network 10.1.1.0 from access to the http (web server) with IP 1.1.1.1 placed in the outside network, create an ACL as shown:

ciscoasa(config)#access-list 100 extended deny tcp 10.1.1.0 255.255.255.0
host 172.16.1.1 eq 80
ciscoasa(config)#access-list 100 extended permit ip any any
ciscoasa(config)#access-group 100 in interface inside

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Re: Hi Jon,

beatinger — Thu, 18 Jun 2020 15:16:10 GMT

I have tried this command on my ASA 5540, with 9.x IOS, and the following occurred:

ciscoasa5540(config)# shun 65.197.196.0 netmask 255.255.255.0
^
ERROR: % Invalid Hostname
ciscoasa5540(config)# shun 65.197.196.0 netmask 255.255.255.0

Can you please let me know how this is done correctly? Thank you very much!