Cisco 500 Series, Configuration Manual

Page: 356 / 1140

18-2
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 18 Permitting or Denying Network Access
Applying an Access List to an Interface
(see Figure 18-1 ). See the “IP Addresses Used for Access Lists When You Use NAT” section on
page 16-3 for information about NAT and IP addresses. The outbound access list prevents any other hosts
from reaching the outside network.
Figure 18-1 Outbound Access List
See the following commands for this example:
hostname(config)# access-list OUTSIDE extended permit tcp host 209.165.201.4
host 209.165.200.225 eq www
hostname(config)# access-list OUTSIDE extended permit tcp host 209.165.201.6
host 209.165.200.225 eq www
hostname(config)# access-list OUTSIDE extended permit tcp host 209.165.201.8
host 209.165.200.225 eq www
hostname(config)# access-group OUTSIDE out interface outside
Applying an Access List to an Interface
To apply an extended access list to the inbound or outbound direction of an interface, enter the following
command:
hostname(config)# access-group
access_list_name
{ in | out } interface
interface_name
[ per-user-override ]
You can apply one access list of each type (extended and EtherType) to both directions of the interface.
See the
“Inbound and Outbound Access List Overview” section on page 18-1 for more information about
access list directions.
Web Server:
209.165.200.225
Inside
HR
Eng
Outside
Static NAT
209.165.201.4 10.1.1.14
Static NAT
209.165.201.6 10.1.2.67
Static NAT
209.165.201.8 10.1.3.34
Access List Outbound
Permit HTTP from 209.165.201.4 , 209.165.201.6 ,
and 209.165.201.8 to 209.165.200.225
Deny all others
132210
Implicit Permit
from any to any
Implicit Permit
from any to any
Implicit Permit
from any to any
Security
appliance