Blocking Facebook website with ASA 5510 using fqdn with access-list

godwin osas · ‎11-25-2016

I am trying to block facebook website using fqdn, the problem I am facing is that it block all sites

Here is my configuration.

Step 1

#dns domain-lookup outside

#DNS server-group DefaultDNS

#name-server 8.8.4.4

Step 2

#object network OBJ-FACEBOOK.COM

#fqdn facebook.com

Step 3

#access-list ACL-inside line 1 extended deny ip any object OBJ-FACEBOOK.COM

#access-list Acl-inside line 1 extended permit ip any any

#access-group ACL-inside in interface Inside

When I do show dns, it does show

Name: facebook.com
Address: 31.13.65.36

However when I try to visit any website, it says unable to resolve. Somebody please tell me what is wrong with the configuration.

Thank you for your time.

Marvin Rhoads · ‎11-25-2016

You seem to have summarized what you typed. For instance, you would not specify both ACL entries as line 1.

Please share the output of "show run access-list".

Also please run a packet-tracer as follows:

packet-tracer input inside udp <your host address> 1025 8.8.4.4 53

...and share the output.

godwin osas · ‎11-26-2016

Thank you Marvin for your response:

Below is the result of the show run access-list command.

Before

osa-ASA5510fw# show run access-list
access-list Inside_mpc extended permit ip user LOCAL\godey 192.168.0.0 255.255.255.0 any
access-list Outside_access_in extended permit tcp any object WWW-SERVER eq www
access-list traffic_for_ips extended permit ip any any
access-list Outside_mpc extended permit ip any any
access-list global_mpc extended permit ip any any
access-list wccp-servers extended permit ip host 192.168.0.20 any
access-list wccp-traffic extended permit ip 192.168.0.0 255.255.255.0 any
access-list Acl-inside extended permit ip any any
osa-ASA5510fw#

After

access-list Inside_mpc extended permit ip user LOCAL\godey 192.168.0.0 255.255.255.0 any
access-list Outside_access_in extended permit tcp any object WWW-SERVER eq www
access-list traffic_for_ips extended permit ip any any
access-list Outside_mpc extended permit ip any any
access-list global_mpc extended permit ip any any
access-list wccp-servers extended permit ip host 192.168.0.20 any
access-list wccp-traffic extended permit ip 192.168.0.0 255.255.255.0 any
access-list ACL-inside extended deny ip any object OBJ-FACEBOOK.COM
access-list Acl-inside extended permit ip any any
osa-ASA5510fw#

Packet-tracer output:

osa-ASA5510fw(config)# packet-tracer input Inside udp 192.168.0.6 1025 8.8.4.4$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 Outside

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: Inside
input-status: up
input-line-status: up
output-interface: Outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

You said that "For instance, you would not specify both ACL entries as line 1" I am new to this firewall configuration, could you please tell what should the correct order to write the entries.

Thank you.

Marvin Rhoads · ‎11-26-2016

You have two ACLs with similar names:

access-list ACL-inside extended deny ip any object OBJ-FACEBOOK.COM
access-list Acl-inside extended permit ip any any

Notice the first one begins with ACL as three capital letters. I suspect that is the one you have applied with the access-group command. Thus the second entry never catches the remaining traffic and it is all dropped as phase 2 in the packet-tracer output indicates.

Please confirm with the output of

show run access-group

If my suspicion is correct then add a second entry as follows:

conf t
access-list ACL-inside extended permit ip any any
end
wr mem

...and then re-run the earlier packet-tracer command.

godwin osas · ‎11-26-2016

Thank you Marvin,

Output for show run access-group

Below:

access-group ACL-inside in interface Inside

osa-ASA5510fw(config)# show run access-li
osa-ASA5510fw(config)# show run access-list
access-list Inside_mpc extended permit ip user LOCAL\godey 192.168.0.0 255.255.255.0 any
access-list Outside_access_in extended permit tcp any object WWW-SERVER eq www
access-list traffic_for_ips extended permit ip any any
access-list Outside_mpc extended permit ip any any
access-list global_mpc extended permit ip any any
access-list wccp-servers extended permit ip host 192.168.0.20 any
access-list wccp-traffic extended permit ip 192.168.0.0 255.255.255.0 any
access-list ACL-inside extended deny ip any object OBJ-FACEBOOK.COM
access-list ACL-inside extended permit ip any any
access-list Acl-inside extended permit ip any any
osa-ASA5510fw(config)#

osa-ASA5510fw(config)# show dns
Name: facebook.com
Address: 31.13.70.36 TTL 00:00:18
Address: 157.240.3.35 TTL 00:04:30

For some reason I must have missed something, right now is not even blocking facebook

Thank you for your time.