• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 313
  • Last Modified:

How to block an interface on a schedule

Hi Experts,

I am trying to configure an schedule time on the weekends to block my INTERNET interface at certain hours.
I configured it this way but it doesn't work:
time-range BLOCK-Internet
  absolute end 18:30 27 April 2014
  periodic  Saturday 18:27 to 18:30
 access-list outside_access_out line 1 extended deny ip 10.0.0.0 255.255.255.0 interface outside  time-range BLOCK-Internet
      access-group outside_access_out out interface outside.
My internet interface is define as outside.

The firewall is CISCO ASA 5505 VER 8.4.
Please advise
0
chenzovicc
Asked:
chenzovicc
  • 3
  • 3
1 Solution
 
AkinsdNetwork AdministratorCommented:
absolute end 18:30 27 April 2014
periodic  Saturday 18:27 to 18:30
If nothing else, correct this first

absolute end 18:30 27 April 2014

The absence of "absolute start" means the policy goes into effect immediately, while the absence of an absolute end means the policy stays unless cancelled.
If the time on your ASA is accurate, then absoute end year of 2014 means the policy should cease to apply by 6:30pm April 27 of 2014. We're now in August 2014 meaning that policy has long expired and has no effect.

Also, in that policy, you're only blocking 3 minutes on Saturdays (6:27pm to 6:30pm).

Lastly, you're applying the policy to outbound traffic on the outside interface. The private IPs would have been translated (NAT'd) meaning you will not see traffic matching 10.x.x.x there. You should consider applying the acl to the INBOUND taffic on the INSIDE Interface instead
0
 
chenzoviccAuthor Commented:
I implemented the change but I noticed that will block permanently from the moment I configure the rule.
I would like to implement to block the outside interface on Saturdays and Sundays from 11:00pm to 6:00am the whole year 2014
Please advise
0
 
AkinsdNetwork AdministratorCommented:
You will need to specify periodic times instead. Your absolute end should be a time and date after the last last Sunday in Dec 2014

This will be Monday, Dec 29, 2014
I'm not clear what the goal is but I'll use the interpretation I have and you can modify as desired.
My interpretation:
Block access from Saturday 11pm to 6am Sunday morning, then block access from Sunday 11pm to 6am Monday morning
If so, you'll have to specify individual days
eg
periodic Saturday 23:00 to 23:59
periodic Sunday 00:00 to 06:00
periodic Sunday 23:00 to 23:59
periodic Monday 00:00 to 06:00
absolute end 06:01 29 December 2014


You may be able to just configure the following
periodic Saturday 23:00 to 06:00
periodic Sunday 23:00 to 06:00
absolute end 06:01 29 December 2014

See http://www.ittoday.info/AIMS/DCM/51-10-40.pdf for more info
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
chenzoviccAuthor Commented:
I will apply it tomorrow and give you a feedback.
Thanks
0
 
chenzoviccAuthor Commented:
Thanks for the info and the link you provided.
0
 
AkinsdNetwork AdministratorCommented:
You're welcome.

All the best
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now