topic Re: Access-list in PIX 506E in Network Security

Access-list in PIX 506E

jclim — Fri, 21 Feb 2020 08:40:28 GMT

Dear All,

I would like to block a single IP in the LAN (inside network )to access to the Internet. The following is the configuration

access-list inside_access_in deny tcp host 192.168.1.247 any

access-list inside_access_in permit tcp any any

access-group inside_access_in in interface inside

But instead on one IP address the access-list has block the entire LAN to access the Internet

Kindly advise what is wrong with the configuration.

Thank you

pkhatri — Thu, 26 Jan 2006 09:54:22 GMT

Hi JC,

Change the access-list to:

access-list inside_access_in deny ip host 192.168.1.247 any

access-list inside_access_in permit ip any any

You blocked all non-TCP with your initial config. This would have blocked DNS and nothing much would have worked.

Hope that helps - pls rate posts that help.

Regards,

Paresh

jclim — Thu, 26 Jan 2006 10:21:32 GMT

Hi Raresh,

It's working now