Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2476
  • Last Modified:

Creating Access list rule on ASA5510 using a domain name

I am needing to allow our Symantec AV Server through our ASA 5510 to download updates.  I am only wanting to allow the server out to the symantec site(s).  I contacted Symantec to get a list of IP Addresses they use for their definition downloads.  Symantec indicated they reference a domainname/url and they don't have a list of IP's to give out.  They indicated I only need to reference liveupdate.symantec.com in our firewall and it will work.  How do I create an access-list rule in the ASA to reference liveupdate.symantec.com?
0
angie_lynn
Asked:
angie_lynn
2 Solutions
 
egyptcoCommented:
hi,

such feature would have been great but i'm afraid I've never heard about it. on the asa you should allow ports 80, 21 and 443 (http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/2002041115083313) from your AV Server to any destination in outside and you shouldn't have any problems with the update.
or try this solution with LUAU http://www.symantec.com/connect/forums/liveupdate-behind-firewall 
0
 
FWestonCommented:
Unfortunately, I don't think PIX/ASA support what you're trying to do.  The liveupdate site looks like it's set up in a round-robin DNS configuration, so I'll list the following options in the order of most secure to least secure:

1) add access-lists permitting your internal AV server to access tcp ports 80/21/443 on the six IPs below
2) add a single access-list permitting your internal AV server to access tcp ports 80/21/443 on the 97.65.135.0/24 network
3) add a single access-list permitting your internal AV server to access tcp ports 80/21/443 on any host

Option 2 is probably a pretty safe option that won't require you to update ACLs every month.

FYI - the IP addresses I currently see for liveupdate.symantec.com are:
97.65.135.138, 97.65.135.154, 97.65.135.168, 97.65.135.145, 97.65.135.162, and 97.65.135.178
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

Tackle projects and never again get stuck behind a technical roadblock.
Join Now