cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1007
Views
8
Helpful
10
Replies

Block internet access on PIX

techtips03
Level 1
Level 1

Hello

I have a PIX 506E with 6.3(5) version and I would like to know if I can block internet access to certain users and allow access to some users on the same LAN. I have a SBS server on the LAN.

Thank you

10 Replies 10

andrew.prince
Level 10
Level 10

do you have static IP addresses or DHCP on the LAN?

I have DHCP on the LAN

Kureli Sankar
Cisco Employee
Cisco Employee

You would have to do it individually for the IP addresses that you want to block port 80 and allow the rest. You can use dhcp mac address reservation so, these denied hosts will always get the same ip address.

access-l inside-acl deny tcp host 10.10.10.1 any eq 80

.

.--> add all the denies

.

access-l inside-acl permit tcp any any eq 80

access-g inside-acl in int inside

Thanks Sankar. When you say dhcp mac reservation, do you mean assigning IP address to MAC on the dhcp server so they can get the same IPs?

Exactly. Yes. Reserving an IP address for a MAC address on the dhcp server so, these computers will consistently get the same IP address.

Thank you. What if the users move between 2 different locations which are on VPN? If DHCP server is at both locations I think I can still map their MAC to IPs at both locations. But if the remote location is getting DHCP from the main location on the VPN then this setup will not work right?

if they move with the machines - you have an issues. The you need to think about proxy cut-thru and a radius server to authenticate users.

HTH>

Small change on the above. If I dont add udp, I saw dns issues.

access-l inside-acl deny tcp host 10.10.10.1 any eq 80

access-l inside-acl permit tcp any any

access-l inside-acl permit udp any any

access-g inside-acl in int inside

paul
Level 1
Level 1

One option is running AAA and Cut through proxy. The drawback is that it will ask each user to log in. The Pix cannot tell who the user is from the packets. There is no user information in them. The SBS should be able to function as a Radius server and perform the authentication. I would consider the configuration and intermediate level task.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: