Re-doing firewall rules

[harrisgirls]

Hi,

I want to lock down my firewall, basically anyone on the inside of the network can connect to any resource to the internet (msn, torrents, rdp etc etc).

I want to lock down my firewall so that only http, https, smtp is allowed (i can add more later).

What command lines would I do for the following there?

[Henrik Grankvist]

Are you using Cisco IOS firewall or ASA?

[harrisgirls]

Cisco PIX 515

[harrisgirls]

anyone

[harrisgirls]

Is anyone able to help?

[John Blakley]

If you don't have an acl on the inside interface, the Pix allows all traffic out by default. In order to control what goes out, you'll need an acl Anything that's not in the list will be denied. To do this on the Pix would be like the following:

access-list INSIDE permit tcp any any eq 443

access-list INSIDE permit tcp any any eq 80

access-list INSIDE permit tcp any any eq 25

access-group INSIDE in interface Inside

HTH,

John

Please rate all useful posts...