ASDM internet restriction by IP

[pbenfield99]

Hi, have an ASA 5510, want to restrcit internet access to a specific IP (or range) , I tried to add a rule that did this but it stopped all incoming email ??.

Can you give me some pointerts, I dont want the command line stuff, the web based Admin, is my preferred option.

thanks

Paul

[Panos Kampanakis]

What do you mean by "Hi, have an ASA 5510, want to restrcit internet access to a specific IP (or range)"?

You want to only allow certain hosts to go out?

Certain hosts to come in from the outside?

PK

[pbenfield99]

not concerned about incoming, we currently have the ASA working fine, but I want to deploy a proxy server (squid) and rather than get bogged down by settings on individual pc's, proxy.pac files and wdat.dat files etc. I want to block the direct access to the internet so that the clients will autodetect the proxy and configure themsleves. I want to test this from a user pc , by getting the rule to operate only on a single IP address (so I dont invoke armageddon from the userbase)  does that make it a bit clearer ?

Users are on a their own subnet, so 10.0.0.x is servers, 10.0.1.x are users.

thanks

PaulB

[Panos Kampanakis]

Aplly an ACL on the inside interrface that has

access-l inside-out deny tcp 10.0.1.0 255.255.255.0 any eq 80    <----that will block outbound web
access-l inside-out permit ip any any    <---that will premit everything else outbound, probably you didn't have this when things broke
access-group inside-out in interface inside

For ASDM, put an ACL on the inside interface that denies all destination port 80 for source IP addresses being the users, but below that make sure you allow everything else so you don't deny everything with the implicit deny at the end of the ACL.

I hope it helps.

PK

[pbenfield99]

thanks for your help, will give it a try

PaulB

[Panos Kampanakis]

Let us know if it solves it.

PK