I know there is probably a simple answer to this question, but I cannot find the answer anywhere. I've tried a couple of different things, but none seem to work.
I know that I can't simply block a website unless I have websense, but websense is not needed for what I am doing. How do I block my users from visiting a website using its IP address using the PIX 515E?
Thanks in advance for your time and help!
For future reference: More PIX people hang around in comp.dcom.sys.cisco .
To block your users from visiting a site:
# might as well block the RFC1918 private IPs access-list In2Out deny ip any 10.0.0.0 255.0.0.0 access-list In2Out deny ip any 172.16.0.0 255.240.0.0 access-list In2Out deny ip any 192.168.0.0 255.255.0.0 # block the Zero Configuration range access-list In2Out deny ip any 169.254.0.0 255.255.0.0 # list any other restrictions you want access-list In2Out deny tcp any host WEBSITEIP # end by permitting everything else access-list In2Out permit ip any any # now activate the control access-group In2Out in interface inside
For improved security, instead of permit ip "any", only permit your known internal IP addresses, such as
access-list In2Out permit ip 192.168.42.0 255.255.255.0 any
That way, if something inside starts forging packets with a different IP address range (e.g., part of a DDoS attack) then your PIX will block the packets before they get out to the network. This will also have the benefit of blocking outgoing traffic from machines which have managed to configure themselves with the Zero Configuration (169.254.*.*) address range.
Thanks! Worked like a Charm!
Quick Question:
I tried adding another website to the blocked list, but it did not block it. Here is what I did:
access-list In2Out deny tcp any host WEBSITEIP access-group In2Out in interface inside
Am I doing something wrong?
When you give the access-group command, the access-list you name will remain associated with the interface until:
- you reboot (in which case the saved configuration will be loaded)
- you clear the configuration
- you specifically change it ("no access-group" or access-group naming a different access-list); or
- you remove the access-list named: in that case, the access-group command will be deactivated automatically.
In other words, you didn't have to give the access-group command again after what you did. (It didn't hurt to do so though!)
The difficulty you encountered is that when you give a new access-list command naming a previous access-list, the new command is added to the -end- of the access-list. access-lists are examined from the top down, and your access-list has a permit any statement in it, so that permit would take effect and the new statement would not even be examined.
If you "show access-list In2Out" you will see the ACL with line numbers listed, such as
access-list In2Out line 7 permit ip any any access-list In2Out line 8 deny tcp any host WEBSITEIP
You can use these line numbers to edit the list in place, with the changes taking effect immediately. When you specify a new ACL entry with the line number of an existing entry, the new entry is inserted -before- the old one, with the rest "pushed down" in the list:
no access-list In2Out line 8 deny tcp any host WEBSITEIP access-list In2Out line 7 deny tcp any host WEBSITEIP
After that, you would have
access-list In2Out line 7 deny tcp any host WEBSITEIP access-list In2Out line 8 permit ip any any
[Remember to "write memory" to save your changes afterwards ;-) ]Thanks!
Have something to add? Share your thoughts — no account required.
Ask the community — no account required