PIX 515 Blocking non-US IPs

gecko2207 · ‎05-14-2008

Is there a way to block all IPs from outside the US on a PIX 515e version 7.1(1)?

andrew.prince · ‎05-15-2008

Is this from the inside going outside? or outside coming in?

Either way - it would be an exercise in futility.

You bascially talking about blocking 80% of the routable terresteral internet IP space.

gecko2207 · ‎05-15-2008

This would be outside coming in. I know that there is a ton of IP space to block, I could do it with a bunch of access lists using class A or B subnets assigned to RIPE, APNIC,LACNIC, and AfriNIC but I was wondering if there was some easier way?

Thanks,

Brandon

andrew.prince · ‎05-15-2008

Of course there is an easier way - just allow the subnets you want to come in, then the default deny all is applied!