topic Re: Block internet access on PIX in Network Security

Block internet access on PIX

techtips03 — Mon, 11 Mar 2019 15:56:21 GMT

Hello

I have a PIX 506E with 6.3(5) version and I would like to know if I can block internet access to certain users and allow access to some users on the same LAN. I have a SBS server on the LAN.

Thank you

Re: Block internet access on PIX

andrew.prince — Fri, 17 Jul 2009 15:40:26 GMT

do you have static IP addresses or DHCP on the LAN?

Re: Block internet access on PIX

srue — Fri, 17 Jul 2009 16:23:13 GMT

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807349e7.shtml

Re: Block internet access on PIX

techtips03 — Fri, 17 Jul 2009 16:38:18 GMT

I have DHCP on the LAN

Re: Block internet access on PIX

Kureli Sankar — Fri, 17 Jul 2009 17:11:00 GMT

You would have to do it individually for the IP addresses that you want to block port 80 and allow the rest. You can use dhcp mac address reservation so, these denied hosts will always get the same ip address.

access-l inside-acl deny tcp host 10.10.10.1 any eq 80

.--> add all the denies

access-l inside-acl permit tcp any any eq 80

access-g inside-acl in int inside

Re: Block internet access on PIX

techtips03 — Fri, 17 Jul 2009 20:31:33 GMT

Thanks Sankar. When you say dhcp mac reservation, do you mean assigning IP address to MAC on the dhcp server so they can get the same IPs?

Re: Block internet access on PIX

Kureli Sankar — Fri, 17 Jul 2009 21:58:57 GMT

Exactly. Yes. Reserving an IP address for a MAC address on the dhcp server so, these computers will consistently get the same IP address.

Re: Block internet access on PIX

paul — Sat, 18 Jul 2009 00:53:22 GMT

One option is running AAA and Cut through proxy. The drawback is that it will ask each user to log in. The Pix cannot tell who the user is from the packets. There is no user information in them. The SBS should be able to function as a Radius server and perform the authentication. I would consider the configuration and intermediate level task.

Re: Block internet access on PIX

techtips03 — Wed, 22 Jul 2009 16:43:14 GMT

Thank you. What if the users move between 2 different locations which are on VPN? If DHCP server is at both locations I think I can still map their MAC to IPs at both locations. But if the remote location is getting DHCP from the main location on the VPN then this setup will not work right?

Re: Block internet access on PIX

andrew.prince — Wed, 22 Jul 2009 17:22:11 GMT

if they move with the machines - you have an issues. The you need to think about proxy cut-thru and a radius server to authenticate users.

HTH>

Re: Block internet access on PIX

techtips03 — Thu, 30 Jul 2009 20:51:36 GMT

Small change on the above. If I dont add udp, I saw dns issues.

access-l inside-acl deny tcp host 10.10.10.1 any eq 80

access-l inside-acl permit tcp any any

access-l inside-acl permit udp any any

access-g inside-acl in int inside