Block external subnet with asa

[Jonathan Forbes]

Hello

I have a cisco asa 5510 and would like to block a public subnet.

Could some tell me how i can block a whole subnet with an access list. 

Thanks

Jon

[Aditya Ganjoo]

Hi Jon,

You can use the deny statement on the outside access-list applied in the out direction on the interface.

You can also use the shun command to deny the public IP subnet.

shun x.x.x.x netmask x.x.x.x

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[Jonathan Forbes]

Not sure i understand. 

Could you post a sample config of the access list. 

Thanks

[Jonathan Forbes]

I am trying to block our inside users from being able to access Netflix. 

I have all the subnet that Netflix owns and there ip space. 

I plan to build and access list that will block all traffic from inside to outside interface. 

[Aditya Ganjoo]

Hi,

You need to apply the access-list on the inside interface as shown in this example:

Block the HTTP port traffic:

In order to block the inside network 10.1.1.0 from access to the http (web server) with IP 1.1.1.1 placed in the outside network, create an ACL as shown:

ciscoasa(config)#access-list 100 extended deny tcp 10.1.1.0 255.255.255.0
host 172.16.1.1 eq 80
ciscoasa(config)#access-list 100 extended permit ip any any
ciscoasa(config)#access-group 100 in interface inside

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[beatinger]

I have tried this command on my ASA 5540, with 9.x IOS, and the following occurred:

ciscoasa5540(config)# shun 65.197.196.0 netmask 255.255.255.0
^
ERROR: % Invalid Hostname
ciscoasa5540(config)# shun 65.197.196.0 netmask 255.255.255.0

Can you please let me know how this is done correctly?  Thank you very much!

[Akbar ali Sultan]

create object group and include all netflix ip,=>deny (source any destination netflix-subnet service IP )  apply in your internal or DMZ interface depend on your traffic route