ACL config guidance

[tcrane8080]

we are looking at having a 172.168.40.0 network on our LAN. BUT i want to tie it down to JUST accessing the internet!

So i'm looking for some ideas on how that ACL would look like.

i have an ASA 5510 as our firewall and i've attached a simple network diagram for reference.

Thanks

[varrao]

Hi,

What you can do is restrict the access to port 80 and port 443 for this particualr subnet on the inside interface, something like this:

access-list inside_access_out extended permit tcp 172.168.40.0 255.255.255.0 any eq 443

access-list inside_access_out extended permit tcp 172.168.40.0 255.255.255.0 any eq 80

access-list inside_access_out extended permit ip any any

access-group inside_access_out in interface inside

The last access-list is important to give all the others ubnets complete access to the outsidfe world.

Hope this helps you.

Thanks,

Varun

[tcrane8080]

thanks for the reply...

Am i correct in thinking that once the ACLis applied, the 172 network would only be able to see WWW and not the rest of the network?

Gary

[varrao]

Yes, once you apply the access-list, they woudl only be able to access the internet for port 80 only and nothing else.

Thanks,

Varun

[tcrane8080]

one more caveat,

my boss reminded me that the 172.168. clients will need to have DHCP services.

so i SHOULD be able to add ports 67 and 68 to the ACL list?

right?

[varrao · Accepted solution]

Yes you can add these services anytime on the ACL.

Varun

[tcrane8080]

groovy!  thanks.

[JohnTylerPearce]

access-list inside_access_out extended permit tcp 172.168.40.0 255.255.255.0 any eq 443

access-list inside_access_out extended permit tcp 172.168.40.0 255.255.255.0 any eq 80

access-list inside_access_out extended permit ip any any

It would still allow access for anyone on 172.168.40.0 to the internet on any port. Anything hitting

the inside interface inbound making TCP ports 443 and 80 will be allowed as well as anything else

hitting that interface.