topic Hi Alexa, in Network Security

CISCO 5505

alexa — Tue, 26 Mar 2019 00:57:44 GMT

hello all-

i am trying to find some information how can i create a firewall rule to only allow DNS (TCP/UDP) so ports 443/53 UDP are open to 208.67.222.222. i want to allow TCP/UDP IN/OUT to 208.67.222.222 or 208.67.220.220. any help would be greatly appreciated.

thanks

Hi Alexa,

rvarelac — Thu, 17 Dec 2015 23:57:39 GMT

Hi Alexa,

The ASA is a stateful firewall which means it will keep a connection table and permit the traffic initiated from a higher security level to a lower security level. For example the traffic initiated from the inside network to outside ( internet) will be allowed.

If the DNS request or connection is generated from outside to inside from this servers, you can try the following config:

access-list Out_ACL permit udp 208.67.222.222 any 53

access-list Out_ACL permit udp 208.67.222.220 any 53

access-group Out_ACL outside in

Hope it helps

-Randy-

hi,

johnlloyd_13 — Fri, 18 Dec 2015 07:46:25 GMT

hi,

just to add randy's post, if you're doing DNS zone transfer, you may want add DNS TCP port 53.

there's also an ACL implicit deny so you may want to add a line to permit other traffic.

access-list Out_ACL permit tcp 208.67.222.222 any domain
access-list Out_ACL permit tcp 208.67.222.220 any domain
access-list Out_ACL extended deny tcp any any eq domain
access-list Out_ACL extended deny udp any any eq domain
access-list Out_ACL permit ip any any