Cisco ASA Port Access & Blocking

[Cash2106]

Hi there,

                 Dear Professionals, i am using cisco asa firewall 5520,

can anyone tell me how can i block all the ports for clients and give them access to some specific ports. please tel me.

[Marius Gunnerud]

I don't quite follow where you are accessing from.  Is this from internet to a server? from inside interface to a DMZ?  Please provide more details to what you are trying to achieve.

[Cash2106]

@Marius Gunnerud  suppose, in my network one client is using internet services from the Cisco ASA, connected through the inside interface network, and all i want is to block all ports on that client and only allow http, pop, smtp and any other specific port so client can use only allowed ports.

[Marius Gunnerud]

All that is is an access-list permitting the host access towards the ports you want (client IP as source, any as destination, and destination port).  Then directly below  these allow rules you place a deny rule that has the client IP as source and any destination.  I unfortunately do not have access to an ASDM at the moment if that is what you are using, but it is quite simple to do in both ASDM and CLI.  Here is an example with the CLI:

access-list inside_in extended permit tcp host 1.2.3.4 any eq www

access-list inside_in extended permit tcp host 1.2.3.4 any eq pop3

access-list inside_in extended permit tcp host 1.2.3.4 any eq smtp

access-list inside_in extended deny ip host 1.2.3.4 any

access-list inside_in extended permit ip any any <--permit all other hosts full access

access-group inside_in in interface inside

If you already have an access-list configured on the interface then the last command is not needed.  Just add the access list entries to the existing ACL

[Cash2106]

@Marius Gunnerud  can you please tel me how can i do that in ASDM because its easy for me to configure please tel me how can i configure it in GUI mode please............

[Marius Gunnerud · Accepted solution]

Please see the attached file for access rule configuration through ASDM.

[Cash2106]

@Marius Gunnerudyou are a true Gem ... thanks for your concern, i am really learning from everyone around, and i am getting more then what i expected from here to learn thanks alot.

[MHM Cisco World]

Object client 

host ip

!

access list outbound permit tcp object client any eq http

!

access group Outbound in interface inside

this for make client only access http other traffic will drop at asa

[Cash2106]

@MHM Cisco World  thanks for your concern, can you please tel me how i can do that in ASDM