I want to control access coming from the inside interface going to the outside as well as 2 DMZ's that I have setup on a PIX. With ASA in place, I already have access to those 3 legs, but I want to lock them down via acl's (such as only www traffic to outside, only telnet traffic to dmz1, etc, etc).
How would something like this work? Would I have to config all the acl's with subnet info? I am thinking this could be a problem in the area of internet traffic, such as an acl like this:
"access-list acl_in permit tcp 10.0.0.0 255.0.0.0 any eq www"
"access-group acl_in in interface inside"
which would be nessecary to lock down internal users to www traffic only, but at the same time, would allow them to initiate www requests on ALL of the DMZ's as well....is there anyway around this? (I'm also doing interface PAT on the outside interface if that helps at all)...
