Solved

How to deny TCP traffic by IP Address on ASA 5510

Posted on 2008-10-20
3
1,410 Views
Last Modified: 2012-05-05
I'm trying to hunt down a device on my network with an IP address of 192.168.1.75, not showing up in DHCP leases. The method I want to use in finding out what it is / who it belongs to is to deny all traffic to it at the firewall level, in hopes someone will speak up.  Is there a command that can do this?
0
Comment
Question by:djhath
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 4

Accepted Solution

by:
urgoll earned 500 total points
ID: 22760684
If you have managed switched, it might be easier to figure out its MAC address (using ping for example) once you have identified its subnet. Then query your switch to see where it hears that specific MAC address from. Once you have the port, it shouldn't be too difficult to get to the device.

That said, the way to block traffic is to create an access list and apply it to an interface. Suppose you have a firewall with two interfaces: inside and outside; support the offending device is on the inside. You could something like the snippet; it prevents the offending address from going outside (Internet, presumably), while allowing all other addresses. the acl_out prevents any incoming connections to it. There's no 'permit ip any any' on the acl_out access-list, as it would effectively open the firewall to all traffic.

IMPORTANT NOTE: do NOT copy paste the stuff below, what your access-lists should be depend on your topology, security policies and services you need to allow through.  The approach above (using managed switches) is much more preferable and doesn't depend on someone speaking up.

Good luck,
Christophe


access-list acl_in extended deny ip host 192.168.1.75 any
access-list acl_in extended permit  ip any any
access-group acl_in in interface inside
 
access-list acl_out deny ip host 192.168.1.75 any
...
access-group acl_out in interface outside

Open in new window

0
 
LVL 3

Author Comment

by:djhath
ID: 22760874
Thank you for your detailed explanation.

I identified the MAC address of the offending IP by ARP cache.  Moreover, I attempted to identify the MAC address by listing the address table on my Enterasys switching stack and there are no matching ones.  It could be a wireless device, I suppose.  

I believe I'm going to attempt the ACL on the firewall.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22762169
Solarwinds Engineers toolset has a neat tool called switchport mapper. Download the free 30 day trial and run the application. It will compare the mac-address table with the arp cache of gateway router, use wins, netbios, dns lookups, use manufacturer table to tell you the brand of NIC. All of this together in a nice table for each port on the switch. It might help you.
http://www.solarwinds.com
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question