Showing results for 
Search instead for 
Did you mean: 
Join Customer Connection to register!

Access-Control Issue

Our main internet router has two firewall's at our site, one of the asa's is ours the other is a client asa, the client asa has a ipsec tunnel and a riverbed steelhead caching device that goes back to there site in the usa. this is then used by the client to access servers on oursite, the previous network engineer setup the asa's etc.. so that 

Client ASA has one of our outside facing ip's lets say ( we don't have any access or control to this ASA other than knowing that they point to and to

there are then the two servers with NAT on our asa that point the servers from to and to

as per the picture when a client goes to on there network it goes from the cache device to our asa outside ip (defined on there asa) and then send data and the same for my issue is that i need to block and from the rest of the internet, my thought was that i could just connect differently and use internal ip's over different the space interface i have however for now i need to band aid the problem until it can be coordinated, i therefore tried to block and from the rest of the internet by using the command 

access-list 102 deny ip any 

access-list 102 deny ip any 

however after i had put this in i ended up with the following in the config 

Extended IP access list 102
    10 deny ip any any

and as a result 1.1.17 and are still routable from the internet, can anyone give me info on what i am doign wrong

vishal vyas

Please check your outside access list on ASA.

#access-list outside deny any host

#access-list outside deny any host

will that not also block access from the outside ip of ? i was trying to do it at the router as the firewall is already beyond the point of the internet

Here we are just specifying IP address of the 2 servers, (host) word indicate just that particular ip, like we do on router ( is the same thing.  

thanks but i need "any" apart from, 

so by doing #access-list outside deny any host that would stop internet traffic going to the server but would also stop the traffic from to


access-list outside line 1 extended permit host any

#access-list outside line 2 extended deny any host

#access-list outside line 3 extended deny any host

on the asa ? rather than blocking it prior to getting to the internet vlan 105 that all devices are in?

You can block the traffic on vlan 105

but please make sure that first add all the permit statment

ip acceess-list extended TEST permit ip any

ip acceess-list extended TEST permit ip any

ip acceess-list extended TEST deny ip  any host

ip acceess-list extended TEST deny ip  any host

add permit any any at the end