https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583786#M594605 <P>I have been fighting the ackantta virus for quite some time now. The decision has been made to lock down every port except for a select few (e.g. 80, 443, 21, 8080...)</P><P>My question is, "How do I create an outbound ACL that blocks all outbound traffic except for specific ports. I alerady placed a block on the ports associated with ackantta. </P><P></P><P>BrandtASA# sh run | incl access-list out<BR />access-list outside extended permit tcp any host 10.1.5.50 eq smtp<BR />access-list outside extended permit tcp any host 10.1.5.80 eq smtp<BR />access-list outside extended permit udp any any eq domain<BR />access-list outside extended permit tcp any any eq www<BR />access-list outside extended permit tcp any any eq https<BR />access-list outside extended permit ip 10.0.50.0 255.255.255.0 any<BR />access-list outside extended permit icmp any any<BR />access-list outside extended permit ip any any<BR />access-list outside extended permit tcp any any eq pptp<BR />access-list outside extended permit tcp any host 10.1.5.90 eq smtp<BR />access-list outside extended permit tcp any host 10.1.5.91 eq smtp<BR />access-list outside extended deny tcp any any eq smtp<BR />access-list outside extended deny tcp any any eq whois<BR />access-list outside extended deny udp any any eq 43<BR />access-list outside extended deny tcp any any eq 1033<BR />access-list outside extended deny udp any any eq 1033<BR />access-list outside extended deny tcp any any eq 1035<BR />access-list outside extended deny udp any any eq 1035<BR />access-list outside extended deny tcp any any eq 1050<BR />access-list outside extended deny udp any any eq 1050<BR />access-list outside extended deny tcp any any eq 1052<BR />access-list outside extended deny udp any any eq 1052<BR />access-list outside extended deny tcp any any eq 1059<BR />access-list outside extended deny udp any any eq 1059<BR />access-list outside extended deny tcp any any eq 1060<BR />access-list outside extended deny udp any any eq 1060<BR />access-list outside extended deny tcp any any eq 1061<BR />access-list outside extended deny udp any any eq 1061<BR />access-list outside extended deny tcp any any eq 1062<BR />access-list outside extended deny udp any any eq 1062<BR />access-list outside extended deny tcp any any eq 1063<BR />access-list outside extended deny udp any any eq 1063<BR />access-list outside extended deny tcp any any eq 1070<BR />access-list outside extended deny udp any any eq 1070<BR />access-list outside extended deny tcp any any eq 1074<BR />access-list outside extended deny udp any any eq 1074<BR />access-list outside extended deny tcp any any eq 1087<BR />access-list outside extended deny udp any any eq 1087<BR />access-list outside extended deny tcp any any eq 1089<BR />access-list outside extended deny udp any any eq 1089<BR />access-list outside extended deny tcp any any eq 1090<BR />access-list outside extended deny udp any any eq 1090<BR />access-list outside extended deny tcp any any eq 1091<BR />access-list outside extended deny udp any any eq 1091</P><P>I guess my very basic quesiton is....do I create permit statements just for the select few and deny all others?&nbsp; I confused myself and have fallen and can't get up.</P> Mon, 11 Mar 2019 19:33:14 GMT Scott Payne 2019-03-11T19:33:14Z https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583786#M594605 <P>I have been fighting the ackantta virus for quite some time now. The decision has been made to lock down every port except for a select few (e.g. 80, 443, 21, 8080...)</P><P>My question is, "How do I create an outbound ACL that blocks all outbound traffic except for specific ports. I alerady placed a block on the ports associated with ackantta. </P><P></P><P>BrandtASA# sh run | incl access-list out<BR />access-list outside extended permit tcp any host 10.1.5.50 eq smtp<BR />access-list outside extended permit tcp any host 10.1.5.80 eq smtp<BR />access-list outside extended permit udp any any eq domain<BR />access-list outside extended permit tcp any any eq www<BR />access-list outside extended permit tcp any any eq https<BR />access-list outside extended permit ip 10.0.50.0 255.255.255.0 any<BR />access-list outside extended permit icmp any any<BR />access-list outside extended permit ip any any<BR />access-list outside extended permit tcp any any eq pptp<BR />access-list outside extended permit tcp any host 10.1.5.90 eq smtp<BR />access-list outside extended permit tcp any host 10.1.5.91 eq smtp<BR />access-list outside extended deny tcp any any eq smtp<BR />access-list outside extended deny tcp any any eq whois<BR />access-list outside extended deny udp any any eq 43<BR />access-list outside extended deny tcp any any eq 1033<BR />access-list outside extended deny udp any any eq 1033<BR />access-list outside extended deny tcp any any eq 1035<BR />access-list outside extended deny udp any any eq 1035<BR />access-list outside extended deny tcp any any eq 1050<BR />access-list outside extended deny udp any any eq 1050<BR />access-list outside extended deny tcp any any eq 1052<BR />access-list outside extended deny udp any any eq 1052<BR />access-list outside extended deny tcp any any eq 1059<BR />access-list outside extended deny udp any any eq 1059<BR />access-list outside extended deny tcp any any eq 1060<BR />access-list outside extended deny udp any any eq 1060<BR />access-list outside extended deny tcp any any eq 1061<BR />access-list outside extended deny udp any any eq 1061<BR />access-list outside extended deny tcp any any eq 1062<BR />access-list outside extended deny udp any any eq 1062<BR />access-list outside extended deny tcp any any eq 1063<BR />access-list outside extended deny udp any any eq 1063<BR />access-list outside extended deny tcp any any eq 1070<BR />access-list outside extended deny udp any any eq 1070<BR />access-list outside extended deny tcp any any eq 1074<BR />access-list outside extended deny udp any any eq 1074<BR />access-list outside extended deny tcp any any eq 1087<BR />access-list outside extended deny udp any any eq 1087<BR />access-list outside extended deny tcp any any eq 1089<BR />access-list outside extended deny udp any any eq 1089<BR />access-list outside extended deny tcp any any eq 1090<BR />access-list outside extended deny udp any any eq 1090<BR />access-list outside extended deny tcp any any eq 1091<BR />access-list outside extended deny udp any any eq 1091</P><P>I guess my very basic quesiton is....do I create permit statements just for the select few and deny all others?&nbsp; I confused myself and have fallen and can't get up.</P> Mon, 11 Mar 2019 19:33:14 GMT https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583786#M594605 Scott Payne 2019-03-11T19:33:14Z https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583787#M594607 <HTML><HEAD></HEAD><BODY><P>Hi Scott,</P><P></P><P>The easiest way would be to create permit lines only for the specific ports that you want to allow. All other ports will be denied by the implicit 'deny ip any any' rule at the end of every access-list.</P><P></P><P>Hope that helps.</P><P></P><P>-Mike</P></BODY></HTML> Mon, 10 Jan 2011 17:17:54 GMT https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583787#M594607 mirober2 2011-01-10T17:17:54Z https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583788#M594609 <HTML><HEAD></HEAD><BODY><P>So I should just do something like the following:</P><P></P><P>1) remove access-list outside extended permit ip any any<BR />2) add permit rules to specific ports such as access-list outside extended permit tcp any any eq www</P></BODY></HTML> Mon, 10 Jan 2011 17:41:32 GMT https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583788#M594609 Scott Payne 2011-01-10T17:41:32Z https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583789#M594611 <HTML><HEAD></HEAD><BODY><P>Hi Scott,</P><P></P><P>Exactly. All access-lists have an implicit 'deny ip any any' line at the end even though you can't see it in the config. Because ACLs are processed sequentially and processing stops as soon as a line matches, ACL processing will never go past your 'permit ip any any' line. Instead, just put permit lines for the specific ports you do want to allow and everything else will be denied by default.</P><P></P><P>-Mike</P></BODY></HTML> Mon, 10 Jan 2011 17:59:55 GMT https://community.cisco.com/t5/network-security/outbound-acl-s/m-p/1583789#M594611 mirober2 2011-01-10T17:59:55Z