topic ASDM internet restriction by IP in Network Security

ASDM internet restriction by IP

pbenfield99 — Mon, 11 Mar 2019 19:00:22 GMT

Hi, have an ASA 5510, want to restrcit internet access to a specific IP (or range) , I tried to add a rule that did this but it stopped all incoming email ??.

Can you give me some pointerts, I dont want the command line stuff, the web based Admin, is my preferred option.

thanks

Paul

Re: ASDM internet restriction by IP

Panos Kampanakis — Tue, 26 Oct 2010 15:32:45 GMT

What do you mean by "Hi, have an ASA 5510, want to restrcit internet access to a specific IP (or range)"?

You want to only allow certain hosts to go out?

Certain hosts to come in from the outside?

Re: ASDM internet restriction by IP

pbenfield99 — Tue, 26 Oct 2010 15:40:31 GMT

not concerned about incoming, we currently have the ASA working fine, but I want to deploy a proxy server (squid) and rather than get bogged down by settings on individual pc's, proxy.pac files and wdat.dat files etc. I want to block the direct access to the internet so that the clients will autodetect the proxy and configure themsleves. I want to test this from a user pc , by getting the rule to operate only on a single IP address (so I dont invoke armageddon from the userbase) does that make it a bit clearer ?

Users are on a their own subnet, so 10.0.0.x is servers, 10.0.1.x are users.

thanks

PaulB

Re: ASDM internet restriction by IP

Panos Kampanakis — Tue, 26 Oct 2010 17:00:28 GMT

Aplly an ACL on the inside interrface that has

access-l inside-out deny tcp 10.0.1.0 255.255.255.0 any eq 80 <----that will block outbound web

access-l inside-out permit ip any any <---that will premit everything else outbound, probably you didn't have this when things broke

access-group inside-out in interface inside

For ASDM, put an ACL on the inside interface that denies all destination port 80 for source IP addresses being the users, but below that make sure you allow everything else so you don't deny everything with the implicit deny at the end of the ACL.

I hope it helps.

Re: ASDM internet restriction by IP

pbenfield99 — Wed, 27 Oct 2010 08:43:30 GMT

thanks for your help, will give it a try

PaulB

Re: ASDM internet restriction by IP

Panos Kampanakis — Wed, 27 Oct 2010 13:21:13 GMT

Let us know if it solves it.