blocking http for user

[anthony.dyne]

Hello

We need to block one user from browsing internet and allow all others. For now I only have ACL on the outside interface.

The user is behind the Firewall ( i.e LAN )

Current setup allows all users to browse internet.

appreicate some help

thanks

Anthony

[andrew.prince]

Create another ACL for the "Inside" to deny the specific host and permit all else.

[anthony.dyne]

Hello Andrew

Are these entries correct

access-list INSIDE extended deny tcp host 172.20.20.1 any eq http

access-list INSIDE extended permit ip any any

access-group INSIDE in interface inside

thanks

Anthony

[andrew.prince · Accepted solution]

Right on the money - that will do it.  Just make sure the user will ALWAYS be 172.20.20.1 - if he changes, he will bypass the ACL.

HTH>