puchito
asked on
BLOCK TRAFFIC FROM INSIDE TO OUTSIDE PIX 515
Hi everyone, i have a pix 515 with 4 port switch integrated. I need to limit the internet traffic from inside to outside.
this is my config:
gotten(config)# sh access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024)
alert-interval 300
access-list INSIDE-OG-OUTWAN; 4 elements
access-list INSIDE-OG-OUTWAN line 1 deny ip any any (hitcnt=35)
access-list INSIDE-OG-OUTWAN line 2 permit tcp object-group RED-OG any eq domain
access-list INSIDE-OG-OUTWAN line 2 permit tcp 10.2.1.0 255.255.255.0 any eq domain (hitcnt=0)
access-list INSIDE-OG-OUTWAN line 3 permit udp object-group RED-OG any eq domain
access-list INSIDE-OG-OUTWAN line 3 permit udp 10.2.1.0 255.255.255.0 any eq domain (hitcnt=0)
access-list INSIDE-OG-OUTWAN line 4 permit tcp object-group RED-OG any eq www
access-list INSIDE-OG-OUTWAN line 4 permit tcp 10.2.1.0 255.255.255.0 any eq www (hitcnt=0)
But obviously not let me access the Internet
my internet is in eth0 with security 0 "OUTSIDE"
INSIDE-OG-OUTWAN is security 90
and de acl is aplicated in interface INSIDE-OG
thanks!
this is my config:
gotten(config)# sh access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024)
alert-interval 300
access-list INSIDE-OG-OUTWAN; 4 elements
access-list INSIDE-OG-OUTWAN line 1 deny ip any any (hitcnt=35)
access-list INSIDE-OG-OUTWAN line 2 permit tcp object-group RED-OG any eq domain
access-list INSIDE-OG-OUTWAN line 2 permit tcp 10.2.1.0 255.255.255.0 any eq domain (hitcnt=0)
access-list INSIDE-OG-OUTWAN line 3 permit udp object-group RED-OG any eq domain
access-list INSIDE-OG-OUTWAN line 3 permit udp 10.2.1.0 255.255.255.0 any eq domain (hitcnt=0)
access-list INSIDE-OG-OUTWAN line 4 permit tcp object-group RED-OG any eq www
access-list INSIDE-OG-OUTWAN line 4 permit tcp 10.2.1.0 255.255.255.0 any eq www (hitcnt=0)
But obviously not let me access the Internet
my internet is in eth0 with security 0 "OUTSIDE"
INSIDE-OG-OUTWAN is security 90
and de acl is aplicated in interface INSIDE-OG
thanks!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
regards!
puchito