Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Allow internet access without using 'any' with ASDM

Hi,

I'm wondering if there is an 'easy' way of allowing a host on a DMZ access to the internet (HTTP) but without allowing it access to the internet LAN (also HTTP).

To clarify the scenario, you have an ASA with 3 interfaces. Internal, DMZ, Outside. Lets assume NAT is sorted so can ignore any NATing. I want to allow a host on the DMZ access through the ASA to the internet (over TCP 80), but don't want that same host to have access to the LAN over TCP 80.

I maybe wrong but if you add a rule on the DMZ ACL, (source = host on the DMZ to have access to the internet, destination = any (internet), Service TCP 80) would this not also give the host on the DMZ access to the LAN interface (being as that falls into 'any') also?

So, is there a way of allow a host access to the internet, while still not allowing that host access to more secure networks, without having to add a deny rule also?

Thanks

Terry

3 REPLIES

Re: Allow internet access without using 'any' with ASDM

Write an acl and the first line would be a deny to the inside LAN, then a permit to any.

HTH>

New Member

Re: Allow internet access without using 'any' with ASDM

Thanks Andrew sounds good.

Re: Allow internet access without using 'any' with ASDM

np - glad to help.

462
Views
5
Helpful
3
Replies
CreatePlease to create content