Network Object Group Public IP addresses

[martinbuffleo]

Has any one come up with a neat way of creating a Network Group of public IP addresses.

I have branch offices that currently have the rule

Allow from: Inside to:any service:http

To allow users to browse the web.

But this gives them access to some of the web interfaces that i use to configure devices, on the LAN

What I would like is:

Allow from: Inside to:public IPs service:http

I have thought about

Deny from: Inside to:172.16.0.0/16 192.168.0.0/16 service:http

Allow from: Inside to:any service:http

But that means two rules for each service that has this requirement.

Also tried creating a public group including 0.0.0.0 through 9.255.255.255 but the ASA ASDM bins the command becuase it includes to many hosts.

Does any one have a better way?

[Collin Clark]

But this gives them access to some of the web interfaces that i use to configure devices, on the LAN

You could restrict access to your other management device on those devices instead of on the ASA. That is a more secure solution.

[martinbuffleo]

The web interfaces are password protected and the ASA and switches have access limited to management IP addresses.

I'm just look at the whole defence in depth.