|
Posted by Walter Roberson on June 6, 2006, 2:20 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>I know that I can't simply block a website unless I have websense, but
>websense is not needed for what I am doing. How do I block my users
>from visiting a website using its IP address using the PIX 515E?
For future reference: More PIX people hang around in comp.dcom.sys.cisco .
To block your users from visiting a site:
# might as well block the RFC1918 private IPs
access-list In2Out deny ip any 10.0.0.0 255.0.0.0
access-list In2Out deny ip any 172.16.0.0 255.240.0.0
access-list In2Out deny ip any 192.168.0.0 255.255.0.0
# block the Zero Configuration range
access-list In2Out deny ip any 169.254.0.0 255.255.0.0
# list any other restrictions you want
access-list In2Out deny tcp any host WEBSITEIP
# end by permitting everything else
access-list In2Out permit ip any any
# now activate the control
access-group In2Out in interface inside
For improved security, instead of permit ip "any", only
permit your known internal IP addresses, such as
access-list In2Out permit ip 192.168.42.0 255.255.255.0 any
That way, if something inside starts forging packets with a different
IP address range (e.g., part of a DDoS attack) then your PIX will block
the packets before they get out to the network. This will also have the
benefit of blocking outgoing traffic from machines which have managed to
configure themselves with the Zero Configuration (169.254.*.*) address
range.
| 
XML site map