Access-list command

[gregm]

Does anyone have an example of allowing internal users access to http, https and ftp and block access to everything else?

[mainesy]

I assume you are wanting this outbound (for PIX?)?

access-list %acl_name% permit tcp any any eq www

access-list %acl_name% permit tcp any any eq https

access-list %acl_name% permit tcp any any eq ftp

access-list %acl_name% deny ip any any

access-group %acle_name% out interface inside

That should allow outbound connections that you want and block everything else.

Josh

[Patrick Iseli]

Might be a good idea to be restrictive on the source hosts on the inside interface ACL.

Suppose 192.168.1.0/24 is the internal network !

access-list inside-acl permit tcp 192.168.1.0 255.255.255.0 any eq www

access-list inside-acl permit tcp 192.168.1.0 255.255.255.0 any eq https

access-list inside-acl permit tcp 192.168.1.0 255.255.255.0 any eq ftp

access-list inside-acl deny ip any any

access-group inside-acl in interface inside

Note that out in < access-group %acle_name% out interface inside > just works in FWSM and PIX 7.0 Code.

sincerely

Patrick

[gregm]

Worked, Thanks

By the way I'm using 7.11 code...Working good!

Greg