network problem

hi
our company have network with below specification (in link)
i have 17 VLAN in my network and 400 point for network and internet and i have DHCP server (windows 2003)
my problem is i do not need to made all user to enter to network i mean now the user connect the cable to socket and work without i know
can i made access list in pix firewall or in router to shutdown the some port in access switch (the port i do not need the user to use it to enter to network)
or must i shutdown the port in all switch from switch itself

and i have other question
how i can prevent the user who enter to data base from enter to internet

thanks
nasemabdullaaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

nasemabdullaaAuthor Commented:
0
rsivanandanCommented:
1. For the first step to be achieved, I would suggest you to shutdown all the unused ports on the access layer switches, or else you'll have to go for port security etc which would be a mess to manage.

2. Second question about database, I'm not clear on what is that you're looking for.

Cheers,
Rajesh
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
nasemabdullaaAuthor Commented:
hi
thanks for your reply
>>> Second question about database, I'm not clear on what is that you're looking for
i have database server and its connect to the same network therfore all computer connect to it connecting to internet
i want to prevent user from enter to internet but can enter to my domain and database

and about first question is there any way to do that from router or pix

thanks
thanks
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

rsivanandanCommented:
Naseem,

  I still don't understand, you don't want *a* particular user to access internet?

For the first question, there is no way to introduce it on the router or pix but port security is the only solution if you don't want to shutdown the ports.

Cheers,
Rajesh
0
nasemabdullaaAuthor Commented:
hi
in my network there is database server and its connect to same network (many user use database to enter doc.) about 100 user this user must connect to server (database but not connect to internet)
and i have about 100 user must be able to enter to database server and to enternet

thanks
0
rsivanandanCommented:
Okay so you want to limit just one user, do this;

1. If possible, do not give him a DNS Server address, instead hardcode it.


2. Or, create a fake proxy address and configure it in his web browser, so that whenever he tries, it will die out.

Cheers,
Rajesh
0
nasemabdullaaAuthor Commented:
hi
i want to block web site from pix

thanks
0
rsivanandanCommented:
If you want to do it in pix, then you'll have to do it step by step;

1. In your dhcp server add a reservation for this particular machine's mac address

(This is to make sure that he gets only this ip all the time).

2. Then on the pix, put in an outbound access-list which prevents his access like one below;

access-list Inside_Out deny ip host <His IP> any eq www
access-list Inside_Out permit ip any any

access-group Inside_Out in interface inside.

Cheers,
Rajesh
0
nasemabdullaaAuthor Commented:
thanks
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Routers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.