topic Access to internet in Network Security

Access to internet

Julio E. Moisa — Mon, 11 Mar 2019 22:39:12 GMT

Good morning,

I have been configuring a cisco ASA 5520, everything is working fine but when i create an ACL:

access-list OUT extended permit ip 172.16.x.x 255.255.255.0 any

access-group OUT out interface outside

i added ports like www or 443 and it is not working to Internet access

a router is before to my firewall connected to my headquater, i can see my private networks but i cannot able to reach Internet access,

could you please help me?

thanks.

Access to internet

Julio Carvajal — Wed, 07 Mar 2012 17:37:02 GMT

Hello Eduardo,

What about the Nat statements, can you provide your Configuration so we can check it.

Regards,

Julio

Access to internet

Adesh Gairola — Wed, 07 Mar 2012 19:43:08 GMT

HiEduardo,

I will try to explain it via an example:

INSIDE(172.16.0.0/24) ----- (172.16.0.1) ASA (1.1.1.1) ----- Internet ----- Google(200.200.200.1)

If users from INSIDE wants to hit internet they will be going through the a PAT on the interface. I am right?

So if you are adding access-list in OUT direction:

access-list OUT extended permit ip 172.16.x.x 255.255.255.0 any

access-group OUT out interface outside

then their is an implicit deny which will deny your natted IP 1.1.1.1. So thats why you cannot reach to internet.

Use packet-tracer to confirm.

So the best option will be allow specfic private addresses on INSIDE interface

Regard,

Adesh

Access to internet

jack samuel — Wed, 07 Mar 2012 19:58:06 GMT

I hope it is same as below,

inside----ASA----router---internet.

Allow DNS with http and 443 and it is better to apply access-list on the inside interface IN direction rather than applying on outside interface out direction

Thnaks