topic Blocking a IP address on ASA in Network Security

Blocking a IP address on ASA

mahesh18 — Tue, 12 Mar 2019 01:31:10 GMT

Hi Everyone,

Need to block all connections going to particular IP address on the internet.

Also we do not want any connection coming from that IP to our ASA.

Need to know which interface should i apply the ACL?

Outside interface of ASA?

Thanks

MAhesh

Blocking a IP address on ASA

lcambron — Thu, 18 Apr 2013 16:23:08 GMT

Hello Mahesh,

If you want to block traffic to that IP from any interface, then you can apply it on the outside interface outbound direction:

access-list name deny ip any host x.x.x.x

access-list name permit ip any any

access-group name out interface outside

Regards,

Felipe.

Blocking a IP address on ASA

mahesh18 — Thu, 18 Apr 2013 16:27:18 GMT

Hi Felipe,

If i need to block traffic coming from that IP to ASA then i can apply it to outside interface but in inside direction?

So when we apply ACL to outside interface of ASA how does it block all other interfaces also?

Thanks

MAhesh

Blocking a IP address on ASA

Julio Carvajal — Thu, 18 Apr 2013 16:38:21 GMT

Hello Mahesh,

If i need to block traffic coming from that IP to ASA then i can apply it to outside interface but in inside direction?

Exactly, inbound direction

So when we apply ACL to outside interface of ASA how does it block all other interfaces also?

Because you will not only block traffic TO the box but also traffic through the box to another devices on other interfaces, this will be block as long as it needs to go via the outside

interface

Blocking a IP address on ASA

Julio Carvajal — Thu, 18 Apr 2013 16:39:14 GMT

Just to add

If traffic to the box is via SSH, Telnet or ASDM you could block it with each of those command sets configuration, no need for an ACL for that traffic,

Regards

Blocking a IP address on ASA

mahesh18 — Thu, 18 Apr 2013 17:14:28 GMT

Hi Julio,

Many thanks again for explaining.

ASA is very interesting.

Regards

MAhesh

Blocking a IP address on ASA

Julio Carvajal — Thu, 18 Apr 2013 17:16:14 GMT

Hello Mahesh,

My pleasure

Regards