Pix 501 - Access Lists, Access Lists, Access Lists

[bwgraybwgray]

Hey Everyone,

I have a small setup and I'm trying to do a little learning here. What I want to do is block a group of interal hosts from accessing the internet, while allowing a couple of others to continue to do so. What I did was the following:

1) Created an object group for the hosts I want to block.

object-group network noweb

network-object host 10.0.0.10

network-object host 10.0.0.11

2) Then I created an access-list to stop these hosts from accessing the internet:

access-list 102 deny any object-group noweb eq www

access-group 102 in interface outside

*So with all of the above I was hoping to block the internet traffic comming back in but no dice.

Did the clear xlate, and refreshed the browsers but no luck.

I'm not that proficient with Access-lists I'm afraid. Pointers would be most appreciated.

Thanks,

BWG

[thisisshanky]

Try doing this.

access-list 102 deny object-group noweb any eq www

access-list 102 permit any any

access-group 102 in interface inside

[bwgraybwgray]

Thanks!!!

Ok so if I understand this right:

access-list 102 deny object-group noweb any eq www <-- stops all web traffic for object-group noweb

access-list 102 permit any any <-- permits all other traffic through? *Help me understand why I need to do this?

access-group 102 in interface inside <-- Applies the access-list to inbound traffic on the inside interface

Many Thanks,

BWG

[thisisshanky]

When you define an ACL, you permit packets that you want to explicitly allow and at the very end tehre is an implicit deny any any statement which is usually not displayed in show run output. This will drop all packets that does not match the ACL.

In this case, your are right on line 1. It stops all web traffic from object-group noweb. Line 2 will permit the rest of the traffic. Otherwise as explained above the rest of the traffic will also be denied.

HTH

[bwgraybwgray]

Awesome!!!

Thank-you! That's what was stopping me was the iplicit deny at the end - I totally forgot!!!

Now all is good. :)