PIX implicit permit rule

[wwbarnes]

I have the need to remove the implicit permit rule on a PIX 501, can this be done?

[gonzalez-j]

Just apply an access list to the interface as follows:

access-list inside deny ip any any

access-group inside in interface inside

By default, when you apply an access list to any interface there is an implied "deny ip any any". However, I like to actually put it inside the access list so I can see it.

Remember, if you add a rule to the access list, the rule gets placed below the "deny ip any any". So you must always execute the following to make your rule active:

no access-list inside deny ip any any

access-list inside deny ip any any

[mjsully]

If you are running a current version of the code, you don't have to take out the deny access-list and put it back in. You can just insert the access-list on what line you specify. This lets you put it above the deny statement.

access-list inside permit line 1 host x.x.x.x host y.y.y.y