topic Re: Locking outbound connection on PIX in Network Security

Locking outbound connection on PIX

support — Fri, 21 Feb 2020 07:14:56 GMT

Hi there,

Could you please advise on how to limit our Outbound connection only letting network users to access HTTP and servers SMTP, DNS etc...

We're currently using PIX515 with the latest sotware.

Thank you in advance.

Re: Locking outbound connection on PIX

jackko — Tue, 17 Feb 2004 23:55:29 GMT

you may configure access list and apply that onto the inside interface of the pix. eg

access-l xxx permit tcp any eq http

access-l xxx permit tcp any eq smtp

access-g xxx in inter inside

one thing should be noticed is that everything else will be blocked. the way i would suggest is to block user ip range only. in that case you, as an admin, plus servers will still have full access. if you think so,

access-l xxx permit tcp any eq http

access-l xxx permit tcp any eq smtp

access-l xxx deny ip any

access-l xxx permit ip any

access-g xxx in inter inside

hope this helps

Re: Locking outbound connection on PIX

support — Wed, 18 Feb 2004 14:57:38 GMT

cheers jackko for the reply.

but how do i apply this if i have 10.0.0.10 to 20 for the Servers and 10.0.0.20 to 50 Users?

Re: Locking outbound connection on PIX

jackko — Thu, 19 Feb 2004 21:11:04 GMT

you can use 'object-group' command. create a network group and add all the user ip into the group. then create access list using the group name rather than ip address. you may also want to re-configure the dhcp pool into proper subnet, as the command doesn't support ip address range.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/mr.htm#1038172

hope this helps

Re: Locking outbound connection on PIX

support — Fri, 20 Feb 2004 18:58:42 GMT

thanks i've read that on the docs. im considering using object group. definitely!

btw with all the virus and trojan going around. would it be posible to start blocking all the ports first then open all those are necessary :-

access-l block deny ip any any

access-l block permit tcp host any eq www

access-g block in interface inside

i tried doing that but my i still cant browse the web. i have a local DNS server on our network i tried adding

access-l block permit tcp host <192.168.0.x> any eq 53

still no joy. any ideas?

thanks again!

Re: Locking outbound connection on PIX

jdepies — Sat, 21 Feb 2004 06:11:04 GMT

Once a match is made the pix does not compare it to the rest of the access-list. It just drops the packet.

There is an implicit deny all at the end of each access-list, so simply open the ones you want, and the rest will be blocked.

Re: Locking outbound connection on PIX

jackko — Sun, 22 Feb 2004 23:34:07 GMT

the access list order is important as the pix checks it from the top to the bottom. ie. the first one you put in there is to deny all traffic.

simply re-order the access list and it should work. btw you don't really need to have 'deny ip any any' as it is the default statement at the end of all access list.

access-l block permit tcp host any eq www

access-l block deny ip any any

access-g block in interface inside

good luck.

Re: Locking outbound connection on PIX

support — Mon, 23 Feb 2004 21:07:18 GMT

great! but how come when i did that, i cant browse the web even though i've allowed my ip for www.

i've also noticed, my internal dns is not resolving anymore.

is there anything missing or need to do?

thanks again!

Re: Locking outbound connection on PIX

jackko — Tue, 24 Feb 2004 07:18:14 GMT

you need to add another access list for the dns. remember to put it above the 'deny any any'

Re: Locking outbound connection on PIX

support — Tue, 24 Feb 2004 20:11:17 GMT

still no joy! i cant browse the web nor resolve any ip.

access-list acc-out permit tcp any host eq 53

access-list acc-in permit tcp host eq 53

access-list acc-in permit tcp host any eq 80

access-list acc-in deny ip any any

static (inside,outside) netmask 255.255.255.255 0 0

access-group acc-out in interface outside

access-group acc-in in interface inside

am i missing anything on my config?

thanks alot!

Re: Locking outbound connection on PIX

laje — Tue, 24 Feb 2004 21:48:02 GMT

Add this to your configuration as dns can use either protocol.

static (inside, outside) netmask 255.255.255.255 0 0

access-list acc-in permit udp host any eq domain

access-list acc-out permit udp any host eq domain

Its advisable locating this dns server in your DMZ.

Re: Locking outbound connection on PIX

support — Wed, 10 Mar 2004 17:57:33 GMT

Hey guys! Thanks for all your help!

Everything seems to be locked down. I can sleep at night now!