ASA5505 Lockdown

Unanswered Question
May 16th, 2008

Hey guys - i have a couple of questions that I hope are quick to answer.

I have a need to provide users with a IP phone at home (extended leave, part timers, etc). The current plan is to provide them an ASA5505 that is configured to create the VPN tunnel over the internet (connects to a ASA5520). We also want to lock down the all the ports execpt e0/0 (outside interface) and e0/7 (the poe enabled phone port). I am tring to configure 5505 so that only the phone will get an ip, AND if they remove the phone, and plug in a desktop/laptop/etc, it wont work (ie - no ip address supplied, ports blocked, etc.). The users will need to use thier existing VPN on thier laptop to get network, we are just trying to supply them a "off site extension" of thier phoens.

So - Question 1 - Can I have the dhcp scope on the asa5505 defined to do a MAC based assignment?

Question 2 - If we cant lock down the scope by mac address, what ports, other than http and skinny (no sip phones here) would/should I block?

If anyone has any other suggstions, im all ears..

Thanks in advance!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
don.click1 Sun, 05/18/2008 - 15:34

thanks. Ive already done the shutdown. Ill check the link (if helpfull, ill rate..)

I am looking to ensure that if they take the phone out, they will get nowhere.

thanks.

don.click1 Tue, 05/20/2008 - 09:43

I have read up on the mac-list, and it seems that would work. My question now - how do I apply that to only 1 interface? Seems to me that, since its a global command, it will restrict on all ports, right?

I need e0/0 to be unrestricted, as I have NO idea what the mac address will be of the "dirty" side, but at the same time, e0/7 should be restricted to only the phone that I supply.

Thanks again for the link

Actions

This Discussion