topic Cisco ASA isolate inside clients in Network Security

Cisco ASA isolate inside clients

ArtCisco — Mon, 29 Jun 2020 13:46:35 GMT

Hello Cisco community! 🙂
I'm facing problem which I can't solve for few days so maybe you guys can help. I have Cisco ASA 5506 with network structure like on attached diagram. I have one "inside" network 192.168.0.0/24. My goal is to isolate all internal clients (PC1,PC2,AP clients) that they couldn't "talk" to each other, but they can go to outside (internet). I don't want to create separate vlans on ASA for every client and aggregate it to selected switched ports (my switches has ability IEEE 802.1Q VLAN tagging), because I need all clients to be in one network for site-to-site connection with our business partner. I have tried to add ACL rules like this:

access-list INS extended deny ip any 192.168.0.0 255.255.255.0
access-list INS extended permit ip any any
access-group INS in interface inside

but it doesn't change anything. I also checked logs to see internal traffic, but it looks like ASA didn't get this traffic.
Do you have any idea how should I achieve my goal?
Have a nice day!

Re: Cisco ASA isolate inside clients

ngkin2010 — Mon, 29 Jun 2020 14:43:50 GMT

PC on the same subnet will not pass through the network gateway (or your firewall). Those layer 2 traffic only forwarded on switches.

If you have Cisco switch, you may use 'private vlan' to do what you want. Other brands switch may have the similar feature, you got to have a check.

Alternatively, you will need to deploy the host based firewall (e.g. windows firewall) to isolate the client within the same broadcast domain.

Re: Cisco ASA isolate inside clients

ArtCisco — Wed, 01 Jul 2020 15:16:59 GMT

Hi,
Thanks for your reply. 🙂

I wasn't sure if internal traffic goes through ASA firewall, so thanks for clarify.

I was thinking about host based firewalls, but in my case it is impossible to deploy, because in network sometimes are temporary PCs and I don't have physical access to them.

I'll try with private vlans. I'm not sure if my switches has this feature, so probably I'll change them.

Thanks again!

Have a nice day!