Blocking a IP address on ASA

[mahesh18]

                   Hi Everyone,

Need to block all connections going to particular IP address on the internet.

Also we do not want any connection coming from that IP to our ASA.

Need to know which interface should i apply  the ACL?

Outside interface of ASA?

Thanks

MAhesh

[lcambron · Accepted solution]

Hello Mahesh,

If you want to block traffic to that IP from any interface, then you can apply it on the outside interface outbound direction:

access-list name deny ip any host x.x.x.x

access-list name permit ip any any

access-group name out interface outside

Regards,

Felipe.

[mahesh18]

Hi Felipe,

If i need to block traffic coming from that IP  to ASA  then i can apply it to outside interface but in inside direction?

So when we apply ACL  to outside interface of ASA  how does it block all other interfaces also?

Thanks

MAhesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

If i need to block traffic coming from that IP  to ASA  then i can apply it to outside interface but in inside direction?

Exactly, inbound direction

So when we apply ACL  to outside interface of ASA  how does it block all other interfaces also?

Because you will not only block traffic TO the box but also traffic through the box to another devices on other interfaces, this will be block as long as it needs to go via the outside

interface

[Julio Carvajal · Accepted solution]

Just to add

If traffic to the box is via SSH, Telnet or ASDM you could block it with each of those command sets configuration, no need for an ACL for that traffic,

Regards

[mahesh18]

Hi Julio,

Many thanks again for explaining.

ASA  is very interesting.

Regards

MAhesh

[Julio Carvajal]

Hello Mahesh,

My pleasure

Regards