Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > PIX- limit web browsing for a specific machine, allowing all others.

Reply
Thread Tools

PIX- limit web browsing for a specific machine, allowing all others.

 
 
barret bonden
Guest
Posts: n/a
 
      01-15-2008
I want to limit web browsing for a specific machine, allowing all others.

Am I better off doing this on the inside or outside interface ?

How do I control the order of the commands in the access-list ? Is it just
a matter of entry order ?



Is this syntax correct for the inside ?

Access-list ach-in deny tcp host 192.168.0.22 any eq 80

Access-list ach-in permit ip any any

Access-list ach-in in interface inside


 
Reply With Quote
 
 
 
 
Walter Roberson
Guest
Posts: n/a
 
      01-15-2008
In article <478cb48b$0$9134$(E-Mail Removed)>,
barret bonden <(E-Mail Removed)> wrote:
>I want to limit web browsing for a specific machine, allowing all others.


>Am I better off doing this on the inside or outside interface ?


Inside, for sure.


> How do I control the order of the commands in the access-list ? Is it just
>a matter of entry order ?


Yes. Though if you have a late enough version of PIX OS, you can
use "line" modifiers to insert before specific lines or delete
specific lines.


>Is this syntax correct for the inside ?


>Access-list ach-in deny tcp host 192.168.0.22 any eq 80


>Access-list ach-in permit ip any any


>Access-list ach-in in interface inside


I do not recall at the moment whether "access-list" is case-sensitive.
The syntax for the rest looks fine. As a practical matter, though,
you may also wish to block common proxy ports as well as port 80.
You might find that easier to manage if you use a port-object
to create the list of ports and then use

access-list ach-in deny tcp host 192.168.0.22 any object-group blocked_ports

 
Reply With Quote
 
 
 
 
mcaissie
Guest
Posts: n/a
 
      01-15-2008

"Walter Roberson" <(E-Mail Removed)> wrote in message
news:K48jj.73269$EA5.16439@pd7urf2no...
> In article <478cb48b$0$9134$(E-Mail Removed)>,
> barret bonden <(E-Mail Removed)> wrote:
>>I want to limit web browsing for a specific machine, allowing all others.

>
>>Am I better off doing this on the inside or outside interface ?

>
> Inside, for sure.
>
>
>> How do I control the order of the commands in the access-list ? Is it
>> just
>>a matter of entry order ?

>
> Yes. Though if you have a late enough version of PIX OS, you can
> use "line" modifiers to insert before specific lines or delete
> specific lines.
>
>
>>Is this syntax correct for the inside ?

>
>>Access-list ach-in deny tcp host 192.168.0.22 any eq 80

>
>>Access-list ach-in permit ip any any



>
>>Access-list ach-in in interface inside


To apply the list on the interface you would need the access-group command

access-group ach-in in interface inside







>
> I do not recall at the moment whether "access-list" is case-sensitive.
> The syntax for the rest looks fine. As a practical matter, though,
> you may also wish to block common proxy ports as well as port 80.
> You might find that easier to manage if you use a port-object
> to create the list of ports and then use
>
> access-list ach-in deny tcp host 192.168.0.22 any object-group
> blocked_ports
>



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Allowing specific elements from another namespace... Simon Brooke XML 2 05-27-2008 05:22 PM
allowing a function to be called only from a specific function junky_fellow@yahoo.co.in C Programming 24 12-01-2006 12:43 PM
Allowing Specific MAC Address Access Albie Cisco 1 11-15-2005 03:01 AM
Norton Internet Security not allowing web browsing pattyjamas@hotmail.com Computer Support 0 12-29-2004 11:35 PM
Browsing specific local directory with FORM METHOD=POST? Jay Vance HTML 5 07-16-2003 10:59 PM



Advertisments