?
Solved

cisco pix accept traffic only from one ip address

Posted on 2008-10-02
4
Medium Priority
?
248 Views
Last Modified: 2010-04-09
Hello, we have a cisco pix 525 and we want to restrict an external ip address from only accepting traffic from one vendor. what would I need to do to do that. i'm fairly new at configuring firewalls and I dont want to open anything that would risk the network. alll comments are appreciated. thank you.
0
Comment
Question by:hherrera
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 23

Expert Comment

by:debuggerau
ID: 22629751
I use accesslists to control permissions in and out. For a particular vendor who needs access to a machine, I just enable an accesslist for a particular time period from a particular IP address (assuming you dont want them to have VPN) through to the machine in question, then they can remote desktop or whatever in..

Do you have the ADSM Launcher for the PIX, it makes configuring it a whole lot simpler and convenient?


0
 

Author Comment

by:hherrera
ID: 22629804
thank you for your comment. can you please guide me on how to get hte adsm launcher and the instructions on how to create the access list with restricitons on the ip address. thank you.
0
 
LVL 23

Accepted Solution

by:
debuggerau earned 360 total points
ID: 22629900
the adsm may have been already loaded, check out the address of the PIX from a browser, using https://<pix ip address>
Else, you'll need a cisco account to get it from their website.

Can you telnet into the PIX, as it can be done from the command line.

access-list outside_access_in extended permit ip host <vendors ip address> host <your external ipaddress> time-range <Vendors time access>

Start with out time for a test, i.e.
access-list outside_access_in extended permit ip host <vendors ip address> host <your external ipaddress>

0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22631076
The thing debugger AU forgot is the access-group command to apply the access-list and make it active.
Can you please post your config? You can get this by running the sh run  command from the command line while at the # prompt. Please copy it and paste it here so I can review it and tell you the appropriate changes to make.
Cheers!
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of the companies I’ve worked with have embraced cloud solutions due to their desire to “get out of the datacenter business.” The ability to achieve better security and availability, and the speed with which they are able to deploy, is far grea…
Powerful tools can do wonders, but only in the right hands.  Nowhere is this more obvious than with the cloud.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question