pix 515 acl

[lyes.ouarti]

hi,

i have a pix 515 installed on my network, i would like to restict access to the internet to all my user.

since i am not a pix expert, can anyone of u give me an example of restrictin access to the internet to all user and allow just www and ftp.

thanks.

[csco10700097]

Hi,

Just make an Access-List on your inside interface, something like this:

access-list inside01 permit tcp any eq www

access-list inside01 permit tcp any eq ftp

access-list inside01 permit tcp any eq ftp-data

and link this to the interface with:

access-group inside01 in interface inside

denial of the rest is by default.

Tom

[#3]

Hi,

I try to connect my private network (192.168.1.0/255.255.255.0) to Internet accross PIX 515E (inside 192.168.1.150/255.255.255.0, outside a.b.c.d/255.255.255.252)

access-list inside01 permit tcp 192.168.1.0 255.255.255.0 any eq www

access-list inside01 permit tcp 192.168.1.0 255.255.255.0 any eq 53

access-list inside01 permit udp 192.168.1.0 255.255.255.0 any eq 53

access-group inside01 in interface inside

global (outside) 1 interface

nat (inside) 1 192.168.1.0 255.255.255.0 0 0

route outside 0 0 a.b.c.e 1

but, when I try connect to the internet from 192.168.1.163, I can see this:

305006 portmap translation creation failed for udp src inside: 192.168.1.160/1031 dst outside /53

I've no static (inside,outside).

Can You help me, pleas?

Thanx, Milan (milan@lanex.cz)