i want to permit specific ip address to deny port

[madudhulamahesh]

Dear cisco

my firewall Name  cisco asa 5505 .. i given command  deny port 80 but now i want to permit this port (80) only for specific ip address ..please help me .

access-list 100 extended deny tcp any any eq www

access-list 100 extended permit ip any any

access-group 100  in interface outside

But My firewall in transparent mode ..

My network setup

Router->firewall->switch->server's

Please help me ....

Regard's&Thank's

mahesh.M

[vishaw jasrotia]

Hello

access-list 100 extended permit tcp any eq 80

access-list 100 extended deny tcp any any eq www

access-group 100  in interface outside

Thanks

[Jouni Forss]

Hi,

If you want to add a rule to an existing ACL you can simply add it to the top of that ACL with the "line" parameter

access-list 100 line 1 permit tcp host host eq 80

or

access-list 100 line 1 permit tcp host any eq 80

Depending if you want to allow TCP/80 to "any" destination or to a specific host.

- Jouni

[madudhulamahesh]

hello sir 

what i am saying

I deny port number 80  all my sever ...but only one user outside of network .so that user only access port number 80..

Example

My  network 10.0.0.15 to 10.0.0.25

i deny port all servers ..but one outside ip address 15.26.69.12 access port number 80

that is my Questions ..

please help me ...

thank you ...

[cadet alain]

Hi,

look at Jouni's second ACL  and replace source address accordingly.

Regards

Alain

Don't forget to rate helpful posts.

[madudhulamahesh]

hello sir

no working

Example network

this is my company network

i done deny port number 80 OUTSIDE in  my netowork(10.0.0.10 to 10.0.0.25 )

But one client want the port number 80.

he is in another network 105.16.15.26(he is in outside of my network )

this ip address only access particular port number 80

please help..

thank you ..

[madudhulamahesh]

Hello

Hello

access-list 100 extended permit tcp <10.0.0.10  > <255.255.255.0> any eq 80

access-list 100 extended deny tcp any any eq www

access-group 100  in interface outside

ip address 10.0.0.10 port number 80 enable   ok .... this ip address  and port number access only particular ip address outside of network ..

please help me ....