Pix 501 block all outbound ports

Posted on 2009-02-23
Last Modified: 2015-01-05
I want to block all outbound ports, then open only ports I need like 80, 8080, 5001, 443 and so on.
Question by:hpmservices
    LVL 32

    Accepted Solution

    LVL 57

    Expert Comment

    by:Pete Long
    Well, you dont need to deny anything as soon as you allow things then everythign else is blocked so
    access-list outbound permit tcp any any eq http
    access-list outbound permit tcp any any eq https
    access-list outbound permit tcp any any eq 8080
    access-list outbound permit tcp any any eq 5001
    access-group outbound in interface inside
     Will only let Ports 80, 8080, 5001 and 443 out and block everything else
    LVL 5

    Expert Comment

    peteLong  has provided correct ans for this
    LVL 12

    Expert Comment

    The Pix assumes that all traffic originating from the inside is safe and therefore allows all outbound connections on any port, by default.
    I think this is a huge security hole and poor design for Cisco or any firewall!

    So, if you define an access-list on the inside interface, as described above, you will effectively limit outbound traffic to only traffic defined in the access-list.


    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Join & Write a Comment

    If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
    Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now