Tolga

If you want to block broadcast traffic from the ASA you can do that by including this in your access list:

deny ip host host 255.255.255.255

This will block all broadcast traffic with a source address of the ASA address.

HTH

Rick

Am I going to include this to my ASA's access list or to router that ASA send broadcast to?

Tolga

You would include this in the access list on the router.

HTH

Rick

I added the line like this but nothing happened

access-list 103 deny ip host 192.168.1.10 host 255.255.255.255

it still broadcasting and router is routing them

Tolga

The syntax looks correct. If it is not blocking the broadcast then we need to check a few things:

- can you verify that 192.168.1.10 is the source address in the broadcast packets?

- can you post the specifics of how you assign the access list to the interface and which interface it is assigned to?

- can you tell us what VLAN, subnet, and interface is the 5110 connected to and what VLAN, subnet, and interface the server is assigned to?

HTH

Rick

Is it possible to add access-list rule to a spesific interface i thought they were global

so while I was in configure terminal mode i wrote

access-list 103 deny ip host 192.168.1.10 host 255.255.255.255

can i make it in different ways

and yes I'm sure its coming from that ip adress but the trick is this

192.168.1.10 is the ip of my asa router 192.168.1.135 sends broadcast to 192.168.1.10 and 192.168.1.10 send this broadcast to actual router with ip adress of 10.0.0.4 and there is a microsoft isa server behind 10.0.0.4 and when i looked to it it says 192.168.1.10 sends a broadcast packet

I want to prevent that packages come to actual router(10.0.0.4)

Thanks

Tolga

It certainly is possible to add an access list rule to a specific interface. You create the access list in global configuration and then you use interface configuration to assign the access list to the interface using ip access-group command. So in global configuration you could create access list 103 and in interface configuration you assign it to one interface. Then in global configuration you could create access list 105 and in interface configuration you could assign access list 105 to another interface. So each interface can have a unique access list.

It is very unusual for an ASA to receive a broadcast from one host and to forward that broadcast. Can you tell us what kind of IP packet this is?

I repeat some of the questions from my previous post. If you provide this information it may help us figure out better what is going on:

- can you post the specifics of how you assign the access list to the interface and which interface it is assigned to?

- can you tell us what VLAN, subnet, and interface is the 5110 connected to and what VLAN, subnet, and interface the server is assigned to?

HTH

Rick