topic block internet access Cisco asa in Network Security

block internet access Cisco asa

AliMahm00di — Fri, 21 Feb 2020 17:10:33 GMT

Hello;

I'm new to IT security world and Cisco as well.

I want to block my inside network (servers) to access the outside world (internet) which is allowed by default in factory-default config of asa 5505.

It is how I get it done:

ciscoasa(config)# object network insidenet

ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0

ciscoasa(config-network-object)# exit

ciscoasa(config)# access-list Restrictinsidenet extended deny ip object insidenet any

ciscoasa(config)# access-g Restrictinsidenet out interface outside

is it ok?

I will appreciate sharing your ideas with me.

Thank you so much. Good luck.

BR/

Re: block internet access Cisco asa

Jon Marshall — Tue, 28 May 2019 21:15:09 GMT

You would be better to apply the acl to the inside interface ie. -

access-group Restrictinsidenet in interface inside

Jon

Re: block internet access Cisco asa

AliMahm00di — Wed, 29 May 2019 05:30:23 GMT

Thanks Jon;

May you please explain why it would be better?

it wouldn't block inside to DMZ?

Thanks so much.

Re: block internet access Cisco asa

Jon Marshall — Wed, 29 May 2019 07:10:10 GMT

Sorry, didn't think about a DMZ 🙂

I tend to apply acls closest to the source so the firewall does not need to process the packets any more than it has to so I would modify the acl and allow traffic from inside to the DMZ then deny to internet as you have done and apply to the inside interface.

However you can do what you are proposing, there is nothing wrong with that.

It comes down to personal preference a lot of the time.

Jon