topic Re: Cannot stopped users connect to Internet Using ASA in Network Security

Cannot stopped users connect to Internet Using ASA

zain_gabon — Mon, 11 Mar 2019 19:30:57 GMT

Dear All,

i have an ASA installed on my network connected to Internet.

I have also Windows Active Directory with users created.

All users connected to Internet at every time

i want to allowed internet by time and stopped certain users,

Can ASA do it with AD?

How can i do it?

Help me

Happy New Years

Regards

Re: Cannot stopped users connect to Internet Using ASA

Jennifer Halim — Thu, 06 Jan 2011 09:23:05 GMT

No, unfortunately you can't integrate ASA with AD for that purpose.

Re: Cannot stopped users connect to Internet Using ASA

zain_gabon — Thu, 06 Jan 2011 09:36:41 GMT

Hello,

Thanks for the answers,

what can i do to stop all users to access Internet any time?

Regards

Re: Cannot stopped users connect to Internet Using ASA

Jennifer Halim — Thu, 06 Jan 2011 09:43:59 GMT

You can create an access-list to stop users from using the Internet, and apply that to the inside interface of the ASA where the users are connected to.

Do you just want to stop web browsing traffic to the Internet, and still allow other type of traffic?

If you do, then here is a sample config of how you can configure it:

access-list inside-acl deny tcp any eq 80

access-list inside-acl deny tcp any eq 443

access-list inside-acl permit ip any any

If you already have access-list applied to the inside interface, you can just add to the existing ACL. Just make sure that the "deny" line is above the permit line.

If you have no access-list applied to the inside interface, then you would need to apply it:

access-group inside-acl in interface inside

Hope that answers your question.

Re: Cannot stopped users connect to Internet Using ASA

Jennifer Halim — Thu, 06 Jan 2011 09:49:26 GMT

Further to that, you can also use the time-range to specify time that you would like user to be blocked or to be permitted from browsing the Internet.

You would need to configure the time-range first, then apply that to your access-list line.

Here is the command reference for time-range:

http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/t.html#wp1527837

and within the time-range, you would need to configure either "absolute" time or "periodic" time:

absolute: http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/a1.html#wp1558494

periodic: http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/p.html#wp1915163

and apply to the access-list accordingly.

For example:

If you would like to allow users to browse the Internet between 13:00-14:00 on weekdays, then you can configure the following:

time-range internet-time

periodic weekdays 13:00 to 14:00

access-list inside-acl permit tcp any eq 80 time-range internet-time

access-list inside-acl permit tcp any eq 443 time-range internet-time

Re: Cannot stopped users connect to Internet Using ASA

zain_gabon — Thu, 06 Jan 2011 10:09:16 GMT

Thanks, Jen,

if i apply an ACL on inside interface, i will block all users.

i want to only block non important users accessing internet during working hours, and keep internet access to all directors for example

regards

Re: Cannot stopped users connect to Internet Using ASA

Jennifer Halim — Thu, 06 Jan 2011 10:26:33 GMT

Then you would need to configure the user ip addresses, or user subnet in the access-list.

Re: Cannot stopped users connect to Internet Using ASA

zain_gabon — Thu, 06 Jan 2011 10:39:20 GMT

Thanks a lot Jennifer

Enjoy your Journey

Regards

Re: Cannot stopped users connect to Internet Using ASA

Jennifer Halim — Thu, 06 Jan 2011 11:10:09 GMT

Cheers, pls kindly mark the post as answered if you have no further question. Thank you.

Re: Cannot stopped users connect to Internet Using ASA

zain_gabon — Thu, 06 Jan 2011 13:04:01 GMT

Sorry Jen,

Answers Done

Thanks