Solved

cisco pix accept traffic only from one ip address

Posted on 2008-10-02
4
247 Views
Last Modified: 2010-04-09
Hello, we have a cisco pix 525 and we want to restrict an external ip address from only accepting traffic from one vendor. what would I need to do to do that. i'm fairly new at configuring firewalls and I dont want to open anything that would risk the network. alll comments are appreciated. thank you.
0
Comment
Question by:hherrera
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 23

Expert Comment

by:debuggerau
ID: 22629751
I use accesslists to control permissions in and out. For a particular vendor who needs access to a machine, I just enable an accesslist for a particular time period from a particular IP address (assuming you dont want them to have VPN) through to the machine in question, then they can remote desktop or whatever in..

Do you have the ADSM Launcher for the PIX, it makes configuring it a whole lot simpler and convenient?


0
 

Author Comment

by:hherrera
ID: 22629804
thank you for your comment. can you please guide me on how to get hte adsm launcher and the instructions on how to create the access list with restricitons on the ip address. thank you.
0
 
LVL 23

Accepted Solution

by:
debuggerau earned 90 total points
ID: 22629900
the adsm may have been already loaded, check out the address of the PIX from a browser, using https://<pix ip address>
Else, you'll need a cisco account to get it from their website.

Can you telnet into the PIX, as it can be done from the command line.

access-list outside_access_in extended permit ip host <vendors ip address> host <your external ipaddress> time-range <Vendors time access>

Start with out time for a test, i.e.
access-list outside_access_in extended permit ip host <vendors ip address> host <your external ipaddress>

0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22631076
The thing debugger AU forgot is the access-group command to apply the access-list and make it active.
Can you please post your config? You can get this by running the sh run  command from the command line while at the # prompt. Please copy it and paste it here so I can review it and tell you the appropriate changes to make.
Cheers!
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question