topic Re: Cisco ASA Port Access & Blocking in Network Security

Cisco ASA Port Access & Blocking

Cash2106 — Mon, 16 Nov 2020 10:26:54 GMT

Hi there,

Dear Professionals, i am using cisco asa firewall 5520,

can anyone tell me how can i block all the ports for clients and give them access to some specific ports. please tel me.

Re: Cisco ASA Port Access & Blocking

Marius Gunnerud — Mon, 16 Nov 2020 10:28:58 GMT

I don't quite follow where you are accessing from. Is this from internet to a server? from inside interface to a DMZ? Please provide more details to what you are trying to achieve.

Re: Cisco ASA Port Access & Blocking

Cash2106 — Mon, 16 Nov 2020 11:57:40 GMT

@Marius Gunnerud suppose, in my network one client is using internet services from the Cisco ASA, connected through the inside interface network, and all i want is to block all ports on that client and only allow http, pop, smtp and any other specific port so client can use only allowed ports.

Re: Cisco ASA Port Access & Blocking

MHM Cisco World — Mon, 16 Nov 2020 21:10:52 GMT

Object client

host ip

access list outbound permit tcp object client any eq http

access group Outbound in interface inside

this for make client only access http other traffic will drop at asa

Re: Cisco ASA Port Access & Blocking

Cash2106 — Tue, 17 Nov 2020 06:02:02 GMT

@MHM Cisco World thanks for your concern, can you please tel me how i can do that in ASDM 😞

Re: Cisco ASA Port Access & Blocking

Marius Gunnerud — Wed, 18 Nov 2020 20:49:20 GMT

All that is is an access-list permitting the host access towards the ports you want (client IP as source, any as destination, and destination port). Then directly below these allow rules you place a deny rule that has the client IP as source and any destination. I unfortunately do not have access to an ASDM at the moment if that is what you are using, but it is quite simple to do in both ASDM and CLI. Here is an example with the CLI:

access-list inside_in extended permit tcp host 1.2.3.4 any eq www

access-list inside_in extended permit tcp host 1.2.3.4 any eq pop3

access-list inside_in extended permit tcp host 1.2.3.4 any eq smtp

access-list inside_in extended deny ip host 1.2.3.4 any

access-list inside_in extended permit ip any any <--permit all other hosts full access

access-group inside_in in interface inside

If you already have an access-list configured on the interface then the last command is not needed. Just add the access list entries to the existing ACL

Re: Cisco ASA Port Access & Blocking

Cash2106 — Thu, 19 Nov 2020 04:28:15 GMT

@Marius Gunnerud can you please tel me how can i do that in ASDM because its easy for me to configure 😞 please tel me how can i configure it in GUI mode please............

Re: Cisco ASA Port Access & Blocking

Marius Gunnerud — Fri, 20 Nov 2020 08:30:41 GMT

Please see the attached file for access rule configuration through ASDM.

Re: Cisco ASA Port Access & Blocking

Cash2106 — Fri, 20 Nov 2020 21:23:36 GMT

@Marius Gunnerudyou are a true Gem 🙂 ... thanks for your concern, i am really learning from everyone around, and i am getting more then what i expected from here to learn 🙂 thanks alot.